Summary #

Netsparker detected that MAC validation is disabled in ViewState data.

Impact #
An attacker can tamper with the application's state variables located in the ViewState data structure.
Actions To Take #
  1. For page-based protection, place the following directive at the top of affected page.
    <%@Page EnableViewStateMAC=true %>
    
  2. You can also set this option for the whole application by using web.config files. Apply the following configuration for your application's web.config file.
    <System.Web>
        <pages enableViewStateMac="true">
    </System.Web>
Remediation #
ASP.NET uses a hash code-based integrity solution called "ViewStateMac" to protect ViewState parameters against tampering attacks. You can implement this solution on a page or application level.
Classifications #
CWE-16, HIPAA-16, ISO27001-A.14.2.5, WASC-15, OWASP 2017-A6
Vulnerability Index

Vulnerability Index

You can search and find all vulnerabilities

OR

Search Vulnerability

Netsparker

Dead accurate, fast & easy-to-use Web Application Security Scanner

GET A DEMO