Back to Checks
vercel

Vercel project has the Web Application Firewall enabled

security_waf_enabled
Service: securitySeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedvercel-pro-plan
Resource Type:NotDefined

Vercel projects are assessed for Web Application Firewall (WAF) enablement. The WAF provides protection against common web attacks including SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats.

Prowler logoProwlerprowler-provider-vercel

Risk

Without the Web Application Firewall enabled, the application is directly exposed to common web attacks including SQL injection, cross-site scripting, request smuggling, and other exploits. Attackers can exploit these vulnerabilities to steal data, deface the application, or gain unauthorized access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks security_waf_enabled

Recommendation

Enable the Vercel Web Application Firewall to protect your application against common web attacks. Start with managed rulesets for baseline protection and add custom rules as needed based on your application's threat model.

Remediation

Other

1Sign in to the Vercel dashboard
2Navigate to the project Settings > Security
3Enable the Web Application Firewall
4Configure appropriate rules and managed rulesets
5Monitor firewall logs for false positives and adjust rules accordingly

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.lib.billing import plan_reason_suffix
from prowler.providers.vercel.services.security.security_client import security_client


class security_waf_enabled(Check):
    """Check if the Vercel Web Application Firewall (WAF) is enabled.

    This class verifies whether each Vercel project has the Web Application
    Firewall enabled to protect against common web attacks.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the Vercel WAF Enabled check.

        Iterates over all firewall configurations and checks if the WAF
        is enabled for each project.

        Returns:
            List[CheckReportVercel]: A list of reports for each project.
        """
        findings = []
        for config in security_client.firewall_configs.values():
            report = CheckReportVercel(metadata=self.metadata(), resource=config)

            if not config.firewall_config_accessible:
                # Firewall config could not be retrieved for this project
                report.status = "MANUAL"
                report.status_extended = (
                    f"Project {config.project_name} ({config.project_id}) "
                    f"could not be checked for WAF status because the firewall "
                    f"configuration endpoint was not accessible. "
                    f"Manual verification is required."
                    f"{plan_reason_suffix(config.billing_plan, {'hobby'}, 'the Web Application Firewall is not available on the Vercel Hobby plan.')}"
                )
            elif config.firewall_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Project {config.project_name} ({config.project_id}) "
                    f"has the Web Application Firewall enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {config.project_name} ({config.project_id}) "
                    f"does not have the Web Application Firewall enabled."
                )

            findings.append(report)

        return findings

References