| name | cis-azure-foundations-7.14 |
| description | Ensure request body inspection is enabled in Azure WAF policy on Azure Application Gateway |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","networking","waf","application-gateway"] |
| cis_id | 7.14 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-7.10","cis-azure-foundations-7.15"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure request body inspection is enabled in Azure WAF policy on Azure Application Gateway
Description
Enable request body inspection so that the Web Application Firewall evaluates the contents of HTTP message bodies for potential threats.
Rationale
Enabling request body inspection strengthens security by allowing the Web Application Firewall to detect common attacks, such as SQL injection and cross-site scripting.
Impact
Minor performance impact on the Web Application Firewall. Additional effort may be required to monitor findings.
Audit Procedure
Using Azure Portal
- Go to
Application gateways.
- Click the name of an application gateway.
- Under
Settings, click Web application firewall.
- Under
Associated web application firewall policy, click the policy name.
- Under
Settings, click Policy settings.
- Ensure the box next to
Enforce request body inspection is checked.
- Repeat steps 1-6 for each application gateway.
Using Azure CLI
Run the following command to list application gateways:
az network application-gateway list
For each application gateway, run the following command to get the firewall policy id:
az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id
For each firewall policy, run the following command to get the request body inspection setting:
az network application-gateway waf-policy show --ids <firewall-policy> --query policySettings.requestBodyCheck
Ensure true is returned.
Using Azure Policy
- Policy ID: ca85ef9a-741d-461d-8b7a-18c2da82c666 - Name: 'Azure Web Application Firewall on Azure Application Gateway should have request body inspection enabled'
Expected Result
All WAF policies associated with Application Gateways should have Enforce request body inspection enabled (requestBodyCheck = true).
Remediation
Remediate from Azure Portal
- Go to
Application gateways.
- Click the name of an application gateway.
