Can malicious users modify viewstate?

Question

If ViewStatemac is enabled in an ASP.NET application, can a user change what is in ViewState and successfully transfer it back to the server?

I have an application (someone else wrote) that uses what is in ViewState to create an unparameterized ORDER BY in an SQL query. Should I worry about SQL Injection?

Answer 1

If ViewStateMAC is enabled, the attacker will have to crack the "machine key" in order to modify the ViewState, so it should be safe enough if this value remains private.

Is the value set in the following code (for example, ViewState["OrderBy"] ), rather than through control? If so, this will not be subject to event verification.

Answer 2

Yes, you can change the view and bring it back by simply copying the page to the local site as html and changing it.

Be that as it may, during the second check, the check will fail and asp.net will not be accepted if you open the EventValidation property - this is open by default.

asp.net saves a hash file for each control and every event on the page of this property and checks it for sending. If this fails, it will not continue. If you have it close, then he can do what you say.

Check out this simple html form:

 <form name="input" action="someaction.asp" method="post"> <select name="sel"> <option value="1" >Milk</option> <option value="2" >Coffee</option> <option value="3" >Tea</option> </select> <input type="submit" value="Submit"> </form> 

anyone can change <option value="1" >Milk</option> to <option value="1 OR 1=1" >Milk</option> and send it back as it is, so you need to add the hash code before render it and send it back along with the rest and confirm that the values ​​that are the same (return the same hash).

Some sites and encoders choose to encrypt each individual value in the response message, if, for example, you see the Amazon, notice lines like:

 <input name="offeringID.1" value="y3A0L7tSnS%2B7LBLvI....morehere" type="checkbox" id="fbt_x_check" style="display: none;" class="check" checked="checked"> 

And if you are using the html user control, you need to add your personal value check to avoid the change.

Asp.net developers decided to make common hash values ​​for all controls and store them in EventValidation.

So keep EventValidation on and the modification will fail.