So I just came across this nasty looking piece of code.

public ActionResult Display(string viewName)
        return View(viewName);

I would avoid having that parameter or at least I would get that parameter through a white-list as I would do with any untrusted data but aside from that I was wondering whether this is actually exploitable or not.

Now what I've tried so far is to get non cshtml files and files outside of the root of the application with no luck. (no view engine supports the searched locations)


The only thing I've been able to is get other views rendered which in theory I shouldn't ever been able to see (Admin actions and stuff of the likes).

But even after getting those views and assuming no data is hardcoded in the views it still doesn't seem to be a big deal.

Is there any other way to take advantage of this parameter? I'm guessing all goes down to whether the View function has an implementation bug that will allow to bypass either the location or type of file to return.

  • Difficult to say without knowing more about the application. For example, are there any checks in the View function? If it's called from multiple places, it might be better to validate/sanitise at that point, so there is a single consistent behaviour for all potential ways to get a view. – Matthew Feb 23 '17 at 16:31
  • This is the built in View function in asp net mvc – EpicVendetta Feb 23 '17 at 16:44

For all practical purposes, there is in fact a whitelist in effect here.

The parameter isn't a file name per se, but a view name, only useful for loading an instance of an already compiled view which is a type implementing the IView interface, from the application. Giving it arbitrary file names, or any content that isn't the name of a view in the context of this controller in this application, and you'll get nothing.

So no, no vulnerability here.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.