Is it possible to trick or reuse VIEWSTATE or determine if it is protected from change?

Question

Question

ASP and ASP.NET web applications use a value called VIEWSTATE in forms. From what I understand, this is used to save some state on the client between requests to the web server.

I never worked with ASP or ASP.NET and needed some help with two questions (and some additional questions):

1) Is it possible to programmatically cheat / construct VIEWSTATE for a form? Clarification: can a program look at a form and from it construct the contents of the VIEWSTATE value encoded in base64?

1 a) Or can it always be simply ignored?

1 b) Could the old VIEWSTATE for a particular form be reused the next time the same form is called, or just succeed if that worked?

2) From http://msdn.microsoft.com/en-us/library/ms972976.aspx#viewstate_topic12 I can learn that protection can be turned on so that VIEWSTATE becomes protected against spoofing. Is it possible for a program to detect that the VIEWSTATE protection is protected in this way?

2 a) Is there a one-to-one mapping between EVENTVALIDATION and safe VIEWSTATE values?

Regarding 1) and 2), if so, can I talk about how I will do this? For 2) I think I could base64 decode the value and look for a string that is always in plaintext VIEWSTATE. "First:"? Something else?

Background

I made a small tool to detect and exploit the so-called CSRF vulnerabilities. I use it to quickly provide evidence of such vulnerabilities that I send to the respective site owners. Quite often, I come across these forms with VIEWSTATE, and I don't know if they are safe or not.

Edit 1: Clarified Question 1. Several.

Edit 2: Added text in italics.

Answer 1

Is it possible to programmatically cheat / construct VIEWSTATE for a form?

Of course. This is just the Base64 encoded value. Now, since ASP.NET 2.0 was an option where the viewstate can be encrypted with a machine key, but it is a function of choice. As a rule, you do not want to include something personal in the state of presentation in the first place.

Or can it always be easily ruled out?

Some of the ASP.NET plumbing require ViewState to shut down completely if you still want to use ASP.NET Server controls.

Could the old VIEWSTATE for a particular form be reused the next time the same form is called, or just succeed if that worked?

This is called a replay attack.

Yes it is possible. Here is a post demonstrating it.

Is there a one-to-one correspondence between EVENTVALIDATION and safe VIEWSTATE values?

Not really. Event validation is primarily used to ensure that an event on the client side matches a “possible” event that could occur on the server. It basically protects and ensures that hidden inputs like __EVENTTARGET are not tampered with.