What are the security implications of a web app firewall/load balancer
revealing internal IPs of the web sites behind it to the outside
If when you say, "internal IPs" you mean the web server's LAN address (i.e. same datacenter, private networking, etc.), then you have a scenario similar to WebRTC revealing your computer's private IP address.
The greater risk is if when you say, "internal IPs," you mean remotely-accessible (i.e public facing) IP addresses that we just don't talk about and rely on security by obscurity for to conceal and protect. In this case, the attack surface here is your entire web server as it is directly accessible from the Internet, and simply learning its IP address would allow an attacker to completely bypass your web application firewall and any blocking & logging it might have.
For defense in-depth, you might consider the following access controls:
- Creating firewall rules on the web server to only allow inbound traffic FROM your load balancer, precluding direct access from any other network/IP, even if it was leaked.
- Removing the server's public IP, and only use private networking
Of course, this implies a balance in security vs. maintainability. I would imagine you will still need a way to remote-in (i.e. VPN, SSH, or possibly via infrastructure management software like Chef, Puppet, continuous integration process, etc.) but the point is that you would do so under tighter access control that would render knowledge of your server's IP mostly useless.