azure-appgw-waf-policy-write
Writing a WAF policy on an Application Gateway allows switching the policy from Prevention to Detection mode (allowing all attacks through) or disabling managed rule sets, weakening L7 security for all backends behind the gateway.
match (effective permission)
{
"action": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Firewall |
| source | <principal> |
| target | <Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies in scope> |
| permissions | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/write |
Narrative
{principal.name} can modify WAF policy {target.name} (ApplicationGatewayWebApplicationFirewallPolicies/write). Switching from Prevention to Detection mode or disabling managed OWASP/Bot Manager rule sets allows previously-blocked L7 attacks (SQLi, XSS, SSRF) to reach backend services.
Raw rule rules/derived/azure/loadbalancer.yaml
id: azure-appgw-waf-policy-write
emits: CanModifyConfiguration
description: Writing a WAF policy on an Application Gateway allows switching the policy from Prevention
to Detection mode (allowing all attacks through) or disabling managed rule sets, weakening L7 security
for all backends behind the gateway.
match_effective_permission:
action: Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Firewall
source: <principal>
target: <Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies in scope>
permissions:
- Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/write
escalation: "Switch policySettings.mode from Prevention to Detection: WAF now logs attacks but no longer\
\ blocks them \u2014 SQLi, XSS, SSRF, path-traversal payloads that were previously rejected now reach\
\ the backend services. Disable managed rule sets (OWASP, Bot Manager) to remove broad exploit coverage."
false_positive_note: Only impactful if the WAF policy is actively associated with an Application Gateway
that is running and serving traffic. A WAF policy not yet attached to any gateway (or attached to
a stopped gateway) reduces immediate impact. A WAF already in Detection mode is already permissive;
switching to Prevention is the secure direction, but modifying from Detection further weakening custom
rules is still significant.
narrative: '{principal.name} can modify WAF policy {target.name} (ApplicationGatewayWebApplicationFirewallPolicies/write).
Switching from Prevention to Detection mode or disabling managed OWASP/Bot Manager rule sets allows
previously-blocked L7 attacks (SQLi, XSS, SSRF) to reach backend services.'