ASP.NET WebForms ViewState MAC integrity protection is disabled

ID

vbnet.misconfiguration.viewstate_mac_disabled

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Misconfiguration

Language

VB.NET

Description

EnableViewStateMac is set to False, disabling the message authentication code that protects ASP.NET WebForms ViewState against tampering. Without the MAC an attacker can forge or modify ViewState, enabling data-integrity attacks and, combined with known machine keys, remote code execution. Leave ViewState MAC enabled (the secure default) by removing this assignment or setting it to True.

Rationale

EnableViewStateMac is set to False, disabling the message authentication code that protects ASP.NET WebForms ViewState against tampering. Without the MAC an attacker can forge or modify ViewState, enabling data-integrity attacks and, combined with known machine keys, remote code execution. Leave ViewState MAC enabled (the secure default) by removing this assignment or setting it to True.

The following code illustrates a vulnerable pattern detected by this rule:

Protected Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs)
    ' VULNERABLE: ASP.NET WebForms ViewState MAC integrity protection is disabled
    Me.EnableViewStateMac = False

    ' VULNERABLE: ASP.NET WebForms ViewState MAC integrity protection is disabled
    EnableViewStateMac = False
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References