DBaffour435534 (Community Member) asked a question.
To Veracode support
I am trying to resolve a medium CWE 502 flaw which the Veracode scan has reported on a scan of our asp.net web form application, targeting the .net 4.5.2 framework. The flaw is
Deserialization of Untrusted Data (CWE ID 502)(1 flaw)
The issue is serialization of the view state which uses the LOS formatter. ASP.NET makes use of LosFormatter to serialize the viewstate and send it to the client as the hidden form field. Once the serialized viewstate is sent back to the server during a POST request. The scan is reporting the error on deserialize as below highlighted.
var losFormatter = new System.Web.UI.LosFormatter();
var reader = new System.IO.StringReader(viewState);
object deSerialized = losFormatter.Deserialize(reader);
ParseViewStateGraph(deSerialized, 0, "", decoded);
Reading the article below from Microsoft, these formatters are to be avoided.
https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide
I tried several alternative serilizers as JSON and XML but this using these has failed as the view state has been serialized natively in ASP.Net in the LosFormatter. I am unsure how to proceed forward.
Please help recommend a solution or can this be mitigated against.
.png){kind=logo}
Hi @DBaffour435534 (Community Member),
Thanks for your question and in-depth analysis of the problem. The recommendation is to not deserialize untrusted data where possible, and in the event that deserialization of untrusted data is required, formats such as JSON or Protocol Buffers are preferred rather than using the vulnerable and risky options. From what you have reported it sounds like Veracode Static Analysis is surfacing flaws from within the ASP.NET framework, which suggests the Review Modules page may need some tuning in order to provide your team with relevant and actionable flaws. You may wish to read this community article to ensure you are correctly selecting only your application components as the entry points: https://community.veracode.com/s/article/What-are-Modules-and-how-do-my-results-change-based-on-what-I-select.
With ASP.NET so long as you do not disable Message Authentication Codes (MAC) for the ViewState and use a strong key for signing, the MAC validation of the ViewState prior to deserialization should be a sufficient mitigation against deserialization of untrusted data. I understand that generally one should expect MAC to be enabled unless manually disabled (via the Windows Registry) of if using a legacy version of ASP.NET, as per https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/. It is a good practice to upgrade to the latest version of ASP.NET if possible and to apply all patches in order to benefit from any security and feature enhancements. Note if the MAC signing key was exposed, an attacker could potentially use the ysoserial.net tool to create a Deserialization payload for the ViewState, specifically abusing the behaviour of the LOSFormatter.
Some useful links on securing the ViewState:
I hope that answers your question.
Many thanks,
Anthony Fielding
Thanks, Anthony for the comprehensive reply. Will try the mitigation solution you have suggested.