Hello GitaraniSharmaMSFT-4262,

Thanks for the details, we believe that the blocked URL is not safe therefore we can't put it in exclude list. but our PEN testing team reported showing 403 here is as security vaulnarabiity, can you please confirm from Microsoft that throwing 403 in this case is the correct way and it is not any security risk so that we can pass your information to our PEN testing team.

Thanks

Hello @Anji Keesari ,

403 code is directly served by the Application gateway when the Application Gateway WAF detects malicious traffic and blocks it. This behavior is correct and do not have any security risk.

Regards,

Allow me to jump in Gita and explain.

Our PEN Testing company raised an issue when the WAF returned a 403 error, citing that it pointed towards a response that confirmed a hacker may conclude this is a route to target. I think this is an entirely fair assessment on their part.
Hackers seek vulnerabilities. Getting a 403 is a common method to probe a deeper attack.
Appreciate you at the Mighty Microsoft, but are you saying that Microsoft have no issue or concern here, and thus we can just refer the PEN testers and any future clients who raise concerns to you here?
Ali Khan

Hello @Ali Khan ,

I believed that the question asked by @Anji Keesari was "Is the WAF responding with 403 error, a correct behavior?". The answer to that question is yes, if the WAF detects malicious traffic, then it will block it with a 403 error. This is by design.
Refer : https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview#waf-modes

Now, I'm not aware of the exact scenario of the pen test results. What was the report? Is the error 403 itself is flagged as a vulnerability? Or it is exposing some server field/header in the error which is causing the vulnerability.

From my past working experience, I have seen customers reporting that the error exposes some server headers which are causing vulnerabilities for them.
For e.g. : https://learn.microsoft.com/en-us/answers/questions/627494/index.html

App gateway v2 allows you to rewrite selected content of requests and responses with some limitations, which helps in such cases.
Refer : https://learn.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url
https://learn.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url#limitations

I would need more details on your pen test reports to further comment on this issue.
Could you please share the exact pen test report/vulnerability?

Regards,

Hello, Gita

Thanks for your response. Very helpful.
The short answer to your question is that we don't expose any field/headers.

The issue the pen testers outline is simply that the 403 response itself should be neutralised to provide no clue to the user that there is something vulnerable to attack.
This is a fair request.

So it's the message itself that is the issue. Does this make sense?

Hello @Ali Khan ,

Thank you for the update.

In this case, my suggestion is to configure a custom error page for the 403 WAF error.
You can configure a custom error page for a 403 web application firewall error or a 502 maintenance page.

Custom error pages can be defined at the global level and the listener level:

You must also specify a publicly accessible blob URL for the given error status code.

Refer : https://learn.microsoft.com/en-us/azure/application-gateway/configuration-listeners#custom-error-pages
https://learn.microsoft.com/en-us/azure/application-gateway/custom-error

Kindly let us know if the above helps or you need further assistance on this issue.

Regards,