ASP.NET Misconfiguration: ViewStateMac Disabled

C#/VB.NET/ASP.NET

Abstract

停用檢視狀態訊息 Authentication 檢查 (MAC) 可讓攻擊者能夠修改 View State。

Explanation

在 ASP.NET，檢視狀態是一種在回傳 (postback) 間持續網路表單狀態的機制。檢視狀態中儲存的資料不受信任，因為沒有防止重複進行攻擊的機制。當停用檢視狀態訊息 Authentication 檢查時，信任檢視狀態將更為危險。停用此項檢查，會讓攻擊者對檢視狀態中儲存的資料任意進行變更，並製造對信任檢視狀態的程式碼的攻擊機會。攻擊者可使用這種錯誤來破解 Authentication 檢查或修改項目定價。
範例 1：以下程式碼停用檢視狀態訊息驗證檢查。


Page.EnableViewStateMac = false;

References

[1] Swapneil Kumar Dash Deep Dive into .NET ViewState deserialization and its exploitation

[2] Standards Mapping - Common Weakness Enumeration CWE ID 353

[3] Standards Mapping - FIPS200 CM

[4] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[5] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[6] Standards Mapping - OWASP Application Security Verification Standard 4.0 3.5.3 Token-based Session Management (L2 L3), 10.3.2 Deployed Application Integrity Controls (L1 L2 L3)

[7] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[8] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[9] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[10] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[11] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[12] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[13] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 2.2.3

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 2.2.3

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 2.2.3

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 2.2.4

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 2.2.4

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 2.2.4

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 2.2.4

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 2.2.6

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 2.2.6

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 2.2 - Secure Defaults

[24] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 2.2 - Secure Defaults

[25] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 2.2 - Secure Defaults

[26] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

[27] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authentication

desc.semantic.dotnet.asp_net_misconfiguration_viewstatemac_disabled