12

We are looking for a Web Application Firewall (WAF) solution for our Sitecore CMS implementation, because we are an Azure shop we specifically wanted to use the WAF feature on the Azure AppGateway resource.

Per Sitecore's knowledge base article, it appears that this is not a supported feature. https://kb.sitecore.net/articles/682999

  • Does anyone know why this isn't supported?
  • Is it the case that no WAF products are supported?
  • Has anyone had experience with Sitecore support pushing back due to the presence of a WAF?

Thank you!

15

Update: Currently WAF is supported in diagnostic mode only for v8.2 and 9.0

In version 9.1 WAF is supported for the CD servers.

More information can be found here: https://doc.sitecore.com/developers/91/sitecore-experience-manager/en/using-azure-application-gateway-to-secure-your-content-delivery-server.html


Below are the list of OWASP rules that are causing problems, and as you can see there are two that cannot be disabled so we there is no work around for WAF right now.

Breaks Site: 942200 942260 942330 942340 942350 942370
Breaks CMS (when going into a piece of content): 941180 942100 942110 942130 942150
Can't be removed in WAF: 949110 980130

| improve this answer | |
  • 5
    For anyone interested, the rules 949110 and 980130 relate to the "total inbound anomaly scores" and are rated as critical. The Security Rules are listed in a GitHub repo at github.com/SpiderLabs/owasp-modsecurity-crs/tree/… – Richard Hauer Apr 3 '18 at 13:21
  • Does Sitecore have an official page which shows this as not supported? Does Sitecore have any recommendations on an alternative WAF? – Brett Larson Jun 20 '18 at 17:13
  • Unfortunately we cannot document everything what we don't support. There is no recommendation for any firewalls I am aware of. – Tamas Varga Sitecore Jun 20 '18 at 19:40
  • Is it supported in Sitecore 9.1? I do not see anything in the release notes. – DevUser Dec 12 '18 at 14:36
  • 2
    Yes, in version 9.1 WAF is supported for the CD servers. I have updated the answer. – Tamas Varga Sitecore Dec 12 '18 at 15:08
3

We tried WAF prevention mode in 9.0.2 (9.0.1 should also work) and made it work in the end. Imp: Sitecore 9.1 won't magically fix it as MS itself is struggling to expose variables to customize Azure WAF parameters.

First time webforms submit failed as 942130 rule blocked it: "Matched Data: ADGTypeValue>Terms found within ARGS:fieldsets.fields.customParams.value: Terms of Use "

so we disabled this rule and the ones below. Keep in mind that 'post' goes through a log checking of its content(body), especially if there is a form that accepts upload(pdf or pics). It is pointless to check all the contents of upload, so we disabled the inspect request body.

enter image description here

We only need this for CD. So just do proper testing and monitor the WAF logs(first in detection mode, in PROD). Run this query in Monitor-> Logs and chill.

search in (AzureDiagnostics) ResourceType == "APPLICATIONGATEWAYS" and 
Resource == "<RG NAME>" | sort by TimeGenerated desc
| where Category == "ApplicationGatewayFirewallLog" 
| where Message like "SQL Injection Attack" 
| where clientIp_s == "<IP of machine doing testing>" //optional

EDIT: Azure WAF 2.0 can have exceptions rules just like windows firewall

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.