services / Azure / Application Gateway WAF policy

An Application Gateway Web Application Firewall (WAF) policy is the managed rule engine that inspects and filters HTTP/S traffic to internet-facing applications fronted by an Application Gateway, blocking common web attacks.

A WAF policy is the security control filtering traffic to public applications; weakening or removing it exposes the fronted apps to attack, so mutation of the policy is a defense/policy concern.

Microsoft.​Network/​ApplicationGatewayWebApplicationFirewallPolicies/​write

Creating/updating the policy lets an attacker rewrite or disable WAF rules (e.g. flip to detection-only or drop rules), removing the security control filtering traffic to the fronted applications.

Risks

1. Policy destruction (CRITICAL)
2. Data manipulation (HIGH)
3. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links