Azure Front Door Web application firewall (WAF) policy rule for Remote Command Execution is disabled

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_133
Category - Subcategory	Public Exposure - Ingress Controls
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	69286a40-1d8c-4f64-a59a-129b38018d58

Impact

Using a vulnerable version of Apache Log4j library might enable attackers to exploit a Lookup mechanism that supports making requests using special syntax in a format string which can potentially lead to a risky code execution, data leakage and more. Set your Front Door Web Application Firewall (WAF) to prevent executing such mechanism using the rule definition below. Azure WAF has updated Default Rule Set (DRS) versions 1.0 and 1.1 with rule 944240 "Remote Command Execution" under Managed Rules to help in detecting and mitigating this vulnerability. This rule is already enabled by default in block mode for all existing WAF Default Rule Set configurations. Learn more around https://nvd.nist.gov/vuln/detail/CVE-2021-44228[CVE-2021-44228]

How to Fix

Resource: azurerm_frontdoor_firewall_policy [source,go]

resource "azurerm_frontdoor_firewall_policy" "example" { name = "example" resource_group_name = "example"

managed_rule { type = "Microsoft_DefaultRuleSet" version = "1.1"

override { rule_group_name = "JAVA"

rule { action = "Block" enabled = true rule_id = "944240" } } } }