Skip to content

View State Mac Disabled

What does this mean ?

The ViewState is a mechanism built in to the ASP.NET platform for persisting elements of the user interface and other data across successive requests. The data to be persisted is serialized by the server and transmitted via a hidden form field. When it is posted back to the server, the ViewState parameter is deserialized and the data is retrieved. By default, the serialized value is signed by the server to prevent tampering by the user; however, this behavior can be disabled by setting the Page.EnableViewStateMac property to false.

What can happen ?

If this is done, then an attacker can modify the contents of the ViewState and cause arbitrary data to be deserialized and processed by the server. If the ViewState contains any items that are critical to the server's processing of the request, then this may result in a security exposure.

Recommendation

There is no good reason to disable the default ASP.NET behavior in which the ViewState is signed to prevent tampering. To ensure that this occurs, you should set the Page.EnableViewStateMac property to true on any pages where the ViewState is not currently signed.

Sample Code

Vulnerable :

<system.web>
  ...
  <pages [..] enableViewStateMac="false" [..]/>
  ...
</system.web>

Non Vulnerable :

<system.web>
  ...
  <pages [..] enableViewStateMac="true" [..]/>
  ...
</system.web>

References