services / Azure / Application Gateway WAF policy

An Application Gateway Web Application Firewall (WAF) policy is the managed rule engine that inspects and filters HTTP/S traffic to internet-facing applications fronted by an Application Gateway, blocking common web attacks.

A WAF policy is the security control filtering traffic to public applications; weakening or removing it exposes the fronted apps to attack, so mutation of the policy is a defense/policy concern.

Microsoft.​Network/​ApplicationGatewayWebApplicationFirewallPolicies/​join/​action

Joining a WAF policy binds a gateway/resource to an attacker-chosen (potentially weaker) policy rather than the intended one, bypassing segmentation/policy controls; flagged Not Alertable.

Risks

1. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links