ASP.NET potentially dangerous request

Question

In my ASP.NET application, I log any application errors that occur, and one of them that appears ocassionally:

A potentially dangerous Request.Form value was detected from the client (ctl00$MainContent$ddl_Months="<a"). 

I understand that this is due to < - however DropDownList does not contain this.

Markup:

 <select name="ctl00$MainContent$ddl_Months" onchange="javascript:setTimeout(&#39;__doPostBack(\&#39;ctl00$MainContent$ddl_Months\&#39;,\&#39;\&#39;)&#39;, 0)" id="ctl00_MainContent_ddl_Months"> <option selected="selected" value="201011">201011</option> <option value="201010">201010</option> <option value="200906">200906</option> <option value="200905">200905</option> <option value="200904">200904</option> </select> 

Code:

Markup

  <asp:DropDownList ID="ddl_Months" runat="server" AutoPostBack="true" OnSelectedIndexChanged="ddl_Months_SelectedIndexChanged" /> 

Code for

 DataTable tblMonths = GlobFunctions.GetData("GetBureauReportsMonths", GlobVar.conStrX, new SqlParameter[1] { new SqlParameter("@BureauNumber", BureauCode) }); List<string> months = new List<string>(); for (int i = 0; i < tblMonths.Rows.Count; i++) { months.Add(Server.HtmlEncode(tblMonths.Rows[i][0].ToString())); } ddl_Months.DataSource = months; ddl_Months.DataBind(); 

I can not replicate this error and wondered what options are available to me to solve this problem?

Answer 1

If you cannot reproduce this, and you have confirmed that all your database values ​​are correct without HTML tag characters, then what you probably see is an attempt to attack your site. Cross-Site Scripting (XSS) attackers like to change the values ​​of list selection options and hidden fields, because many web developers will not think to check these values. The idea (erroneous) is that these values ​​are safe because they are provided by the application, and "ordinary users" cannot change them.

If you can, record and view the context of the request that caused the error (stack trace, session values, request information). Look at the Referrer URL to see if it looks like anything other than what you expect. Look at the remote address (client IP address) and look at WhoIs. This can help you determine where the request came from, which can help you determine if it was a valid request or if it was a bit shadowy.

If this happened with an input field, such as a text field, then it may be your user "accidentally" entering an invalid character. Since this happens with a selected list that is pre-populated, I think the evidence points to an XSS attack. ASP.NET does exactly what it was supposed to do - by preventing inadvertently storing HTML tags where you don't want them.

WiseGuyEh initially mentioned the possibility of XSS in the comments. I don’t think the HTML coding trick will do anything for you in this particular situation, because your database values ​​are all numbers and do not contain the characters that need to be encoded.

Another (possibly remote) possibility is that some quotation marks (") cause damage to the DOM. I only mention this because sometimes I was a victim of it myself, but I doubt that it is applicable here because of the intermittent the nature of your mistakes.

Answer 2

Set the following code in your page directive

 ValidateRequest="false"