Azure Application Gateway Web application firewall (WAF) policy rule for Remote Command Execution is

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_135
Category - Subcategory	Public Exposure - Ingress Controls
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	856f4105-7c71-48b1-87ac-e9a8175d2e3e

Impact

Using a vulnerable version of Apache Log4j library might enable attackers to exploit a Lookup mechanism that supports making requests using special syntax in a format string which can potentially lead to a risky code execution, data leakage and more. Set your Application Gateway (WAF) to prevent executing such mechanism using the rule definition below. Learn more around https://nvd.nist.gov/vuln/detail/CVE-2021-44228[CVE-2021-44228]

How to Fix

Resource: azurerm_frontdoor_firewall_policy [source,go]

resource "azurerm_web_application_firewall_policy" "example" { location = "germanywestcentral" name = "example" resource_group_name = "example"

managed_rules { managed_rule_set { type = "OWASP" version = "3.1" } }

policy_settings {} }