services / Azure / Application Gateway WAF policy

An Application Gateway Web Application Firewall (WAF) policy is the managed rule engine that inspects and filters HTTP/S traffic to internet-facing applications fronted by an Application Gateway, blocking common web attacks.

A WAF policy is the security control filtering traffic to public applications; weakening or removing it exposes the fronted apps to attack, so mutation of the policy is a defense/policy concern.

Microsoft.​Network/​ApplicationGatewayWebApplicationFirewallPolicies/​detachWafPolicyFromAgc/​action

Detaches the WAF policy from an Application Gateway for Containers, stripping the traffic-filtering security control off the gateway entirely and leaving the fronted applications unprotected.

Risks

1. Policy destruction (CRITICAL)
2. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links