ViewState MAC Disabled

Summary #

Invicti detected that MAC validation is disabled in ViewState data.

Impact #

An attacker can tamper with the application's state variables located in the ViewState data structure.

Actions To Take #

For page-based protection, place the following directive at the top of affected page.
```
<%@Page EnableViewStateMAC=true %>
```
You can also set this option for the whole application by using web.config files. Apply the following configuration for your application's web.config file.
```
<System.Web>
    <pages enableViewStateMac="true">
</System.Web>
```

Remediation #

ASP.NET uses a hash code-based integrity solution called "ViewStateMac" to protect ViewState parameters against tampering attacks. You can implement this solution on a page or application level.

Classifications #

CWE-16; HIPAA-164.306(a), 164.308(a); ISO27001-A.14.2.5; WASC-15; OWASP 2017-A6