ViewState MAC Disabled

ID

csharp.viewstate_mac_disabled

Severity

high

Remediation Complexity

low

Remediation Risk

medium

Remediation Effort

low

Resource

Misconfiguration

Language

CSharp

Tags

ASVS50:v1.14.6, CWE:345, NIST.SP.800-53, OWASP:2025:A08, PCI-DSS:6.5.8

Description

ASP.NET Web Forms protects the __VIEWSTATE field with a keyed Message Authentication Code (MAC) so the server can detect tampering when the page is posted back. This detector flags configurations and code that turn that protection off — either the enableViewStateMac="false" attribute on the <pages> element in web.config, or a EnableViewStateMac = false assignment in C# code.

Rationale

The ViewState MAC is what guarantees that the __VIEWSTATE payload returned to the server is the same one the server originally emitted. When it is disabled, an attacker can freely modify the ViewState of any request. This allows tampering with server-side control state and, because ViewState is deserialized on the server, historically enabled ViewState deserialization leading to remote code execution.

Neither enableViewStateMac="true" nor omitting the attribute is a problem — MAC is on by default. Only an explicit opt-out is flagged.

Vulnerable web.config:

<configuration>
  <system.web>
    <pages enableViewStateMac="false" /> <!-- VULNERABLE: ViewState tampering allowed -->
  </system.web>
</configuration>

Vulnerable C# code:

protected void Page_Init(object sender, EventArgs e)
{
    // VULNERABLE: disables ViewState integrity checking for this page
    this.EnableViewStateMac = false;
}

Remediation

Leave ViewState MAC enabled. Remove any enableViewStateMac="false" attribute (or set it to true) and delete any EnableViewStateMac = false assignment in code.

<configuration>
  <system.web>
    <pages enableViewStateMac="true" /> <!-- FIXED (this is also the default) -->
  </system.web>
</configuration>

If ViewState carries sensitive data, additionally set viewStateEncryptionMode="Always" and configure a strong, non-auto <machineKey>. Never disable MAC validation as a workaround for load-balancer or web-farm key-mismatch problems; synchronize the machine key across the farm instead.

References