While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states:

An attacker who successfully exploited this vulnerability could read data, such as the view state, which was encrypted by the server.

I had always heard that encrypted view state was secure. Does anyone have any details on how this exploit works? I did some googling but didn't find any details.

  • Unless you are a few years behind on patches (in which case you have bigger worries), yes, an attacker with enough knowledge of your system may be able to get access to viewstate data and/or manipulate the same... – KristoferA Jul 29 '13 at 17:48

This is the infamous Padding Oracle vulnerability, this is the original paper describing the vulnerability in detail.

View State related exploitation would strongly depend on the actual application logic. If the state information is properly encrypted and integrity checked the application (developer) can safely presume that the included data is trustworthy (e.g. input validation was already performed or the data originates from the server not the client). Without proper defense-in-depth measures in place this can cause a situation similar to a TOC-TOU conflict resulting in a security vulnerability.

Example: PadBuster exploits the fact that the WebResource/ScriptResource handlers presume that their parameter could only properly be set by the server and didn't check for path traversal.

  • Does the encrypted View State depend on the session ID? I.e. can it be replayed infinitely? – eel ghEEz Mar 3 '20 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.