Azure Application Gateway Web application firewall (WAF) policy rule for Remote Command Execution is disabled

Description

Using a vulnerable version of Apache Log4j library might enable attackers to exploit a Lookup mechanism that supports making requests using special syntax in a format string which can potentially lead to a risky code execution, data leakage and more. Set your Application Gateway (WAF) to prevent executing such mechanism using the rule definition below. Learn more around https://nvd.nist.gov/vuln/detail/CVE-2021-44228[CVE-2021-44228]

Code Example

resource "azurerm_web_application_firewall_policy" "example" {
  location            = "germanywestcentral"
  name                = "example"
  resource_group_name = "example"

  managed_rules {
    managed_rule_set {
      type    = "OWASP"
      version = "3.1"
    }
  }

  policy_settings {}
}

Remediation

Terraform

• Resource: azurerm_frontdoor_firewall_policy

Rule Details

Field	Value
ID	IAC-0642
Severity	LOW
IaC Type	arm
Frameworks	Terraform, TerraformPlan
Checkov ID	CKV_AZURE_135

References

• Checkov Rule

---