ViewState MAC Disabled

Summary

Acunetix 360 detected that MAC validation is disabled in ViewState data.

Impact

An attacker can tamper with the application's state variables located in the ViewState data structure.

Actions To Take

For page-based protection, place the following directive at the top of affected page.
```
<%@Page EnableViewStateMAC=true %>
```
You can also set this option for the whole application by using web.config files. Apply the following configuration for your application's web.config file.
```
<System.Web>
    <pages enableViewStateMac="true">
</System.Web>
```

Remediation

ASP.NET uses a hash code-based integrity solution called "ViewStateMac" to protect ViewState parameters against tampering attacks. You can implement this solution on a page or application level.

Severity

Medium

Classification

CWE-16 HIPAA-164.306(a) 164.308(a) ISO27001-A.14.2.5 WASC-15 OWASP 2017-A6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N