ASP.NET ViewState Weak Validation Key

Description

The ASP.NET application is configured with a weak, default, or publicly known validation key used to generate the Message Authentication Code (MAC) for ViewState data. ViewState is a mechanism ASP.NET uses to preserve page and control state across postbacks. When the validation key is compromised, attackers can forge valid ViewState payloads, bypassing integrity checks. This vulnerability enables ViewState tampering and deserialization attacks, which can lead to arbitrary code execution on the server.

Remediation

Immediately replace the weak validation key with a strong, cryptographically random key unique to your application. Follow these steps:

1. Use Auto-Generated Keys (Recommended): Configure the machineKey element in your web.config file to automatically generate unique keys:

<configuration>
  <system.web>
    <machineKey validationKey="AutoGenerate,IsolateApps" 
                decryptionKey="AutoGenerate,IsolateApps" 
                validation="SHA1" 
                decryption="AES" />
  </system.web>
</configuration>

2. Generate Strong Custom Keys (Alternative): If you need to specify keys manually (e.g., for web farm scenarios), generate cryptographically strong random keys of appropriate length (64 hex characters for SHA1 validation, 128 for decryption). Use a secure key generator and never reuse keys from documentation or examples:

<machineKey validationKey="[128 hex characters]" 
            decryptionKey="[64 hex characters]" 
            validation="SHA1" 
            decryption="AES" />

3. Verify Configuration: Ensure the machineKey is defined at the application level, not inherited from machine.config, and that keys are stored securely with restricted file permissions.

4. Test Thoroughly: After updating the keys, test all application functionality to ensure ViewState operations work correctly across all pages and postback scenarios.

References

Related Vulnerabilities