logo

Database

Azure Waf Disabled

Description

Detects Azure Application Gateways that are operating without Web Application Firewall (WAF) protection. WAF provides centralized protection for web applications against common exploits and vulnerabilities like SQL injection and cross-site scripting.

Weakness:

446 - Insecure service configuration - Azure

Category: Functionality Abuse

Detection Strategy

    Reports a vulnerability when an Azure Application Gateway has no firewall policy configured

    Checks the 'firewall_policy' configuration for each Application Gateway instance

    Triggers when the firewall_policy field is empty or missing in the Application Gateway configuration