ViewState MAC Disabled

Summary#

Invicti detected that MAC validation is disabled in ViewState data.

Impact#

An attacker can tamper with the application's state variables located in the ViewState data structure.

Actions To Take#

For page-based protection, place the following directive at the top of affected page.
```
<%@Page EnableViewStateMAC=true %>
```
You can also set this option for the whole application by using web.config files. Apply the following configuration for your application's web.config file.
```
<System.Web>
    <pages enableViewStateMac="true">
</System.Web>
```

Remediation#

ASP.NET uses a hash code-based integrity solution called "ViewStateMac" to protect ViewState parameters against tampering attacks. You can implement this solution on a page or application level.

Classifications#

WASC-15, CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N, ISO27001-A.14.2.5, OWASP 2017-A6, HIPAA-164.306(a), 164.308(a), CWE-16