ViewState MAC Disabled
Severity:
Medium
Summary
Invicti detected that MAC validation is disabled in ViewState data.
Impact
An attacker can tamper with the application's state variables located in the ViewState data structure.
Remediation
ASP.NET uses a hash code-based integrity solution called "ViewStateMac" to protect ViewState parameters against tampering attacks. You can implement this solution on a page or application level.
Required Skills for Successful Exploitation
Actions To Take
- For page-based protection, place the following directive at the top of affected page.<%@Page EnableViewStateMAC=true %>
- You can also set this option for the whole application by using
web.configfiles. Apply the following configuration for your application'sweb.configfile.<System.Web>
<pages enableViewStateMac="true">
</System.Web>
Vulnerability Index
You can search and find all vulnerabilities
Select Category
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Build your resistance to threats. And save hundreds of hours each month.
