checkov scanning web application firewall policy terraform module

Ganesh Thorave 31 Reputation points
2023-09-15T16:11:59.3666667+00:00

I am scanning my terraform module using checkov scan for any loopholes and it

is asking to fix log4j and provided the url as below

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-code-security-policy-reference/azure-policies/azure-networking-policies/ensure-application-gateway-waf-prevents-message-lookup-in-log4j2

however there is no specific information how to fix this as I am already having that definition in my terraform module

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,063 questions
Azure Web Application Firewall

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. ChaitanyaNaykodi-MSFT 26,101 Reputation points Microsoft Employee
    2023-09-15T18:31:02+00:00

    @Ganesh Thorave

    Thank you for reaching out.

    Based on my understanding of your question above, while performing a Checkov scan on your terraform module, you were prompted to apply a fix for Apache Log4j 2 vulnerability.

    The remote code execution (RCE) vulnerabilities in Apache Log4j 2 referred to as “Log4Shell” (CVE-2021-44228, CVE-2021-45046, CVE-2021-44832) had presented a new attack vector and gained broad attention due to its severity and potential for widespread exploitation.

    In response to this threat, Azure Web Application Firewall (WAF) has updated OWASP ModSecurity Core Rule Set (CRS) version 3.0/3.1/3.2 available for Azure Application Gateway V2. For Azure Application Gateway V2 regional deployments, new rule Known-CVEs/800100 was introduced in the rule group Known-CVEs under Managed Rules. Customers are recommended to enable WAF policy with OWASP ModSecurity Core Rule Set (CRS) versions 3.0/3.1/3.2 on Application Gateway V2 to immediately enable protection from this threat. This is currently documented in this blog post here.

    Based on the link you shared above.

    If you have already enabled OWASP ModSecurity Core Rule Set (CRS) version 3.0/3.1/3.2 ruleset for your WAF then you need to take no further action as you are protected from Apache Log4j 2 vulnerability.

    Hope this helps! Please let me know if you have any additional questions. Thank you!

    ​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

  2. Dan Rios 1,985 Reputation points MVP
    2023-09-15T18:31:30.37+00:00

    Hi there,

    Take a look at this GitHub issue on a similar issue, is this relevant for your situation?

    https://github.com/bridgecrewio/checkov/issues/2101

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.