There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF attack, an attacker will have to be able to get both viewstate value and event validation value. If that is the case, is the form safe from CSRF attacks?


Change password forms are commonly bad targets for CSRF attacks as, if they're following good practice, they'll require the users existing password (failure to do so would be a security weakness in and of itself), which someone exploiting a CSRF vuln. is unlikely to know (and if they did, in most cases they would just use that and not bother with CSRF)

Viewstate and event validation won't, in and of themselves, provide complete protection from CSRF if the attacker has an account on the app and can get valid values to submit. The user of ViewStateUserKey can protect against CSRF (See this question) for more details.

| improve this answer | |
  • @Rory McCune: Thanks, that makes sense. Is there any way to know from the external if ViewStateUserKey is enabled? From a pen tester's perspective I mean? – user63518 Dec 16 '14 at 5:21
  • 1
    @user63518: Yes. Log into the application as two similar users with different usernames (where the page state will be pretty much the same for them both). Check the ViewState to see if the values are the same. You can also try inserting the value from one user into the other session (e.g. via Burp) and check whether any error is encountered. – SilverlightFox Dec 16 '14 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.