ASP.NET View State without MAC enabled

Summary: ASP.NET's ViewState mechanism serializes interface and other data into a hidden form field that the server signs by default to prevent tampering, but setting Page.EnableViewStateMac to false disables that signing. With signing off, an attacker can modify the ViewState contents so arbitrary data is deserialized and processed by the server, potentially executing code through a gadget chain.
Key Takeaway: A single page with ViewState signing disabled can let an attacker deserialize their own data on your server, and PortSwigger states there is no good reason to turn off the default signing behavior.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026