处理无效的viewstate错误

Question

我们有一些安全/渗透测试人员测试我们的ASP.NET应用程序,他们发现了一些被认为是跨站点脚本漏洞的东西.据我所知,看起来他们通过将文本<ScRiPt>alert(1)</ScRiPt>插入其中一个viewstate参数来手动操作回发的视图状态.出于某种原因,即使我们在web.config中指定了自定义错误处理程序,服务器似乎也会忽略它们,只是回显一般错误消息,并逐字显示viewstate.因此,<ScRiPt>alert(1)</ScRiPt>浏览器中的运行会导致测试人员将此识别为跨站点脚本问题.无论这是否是一个合法的漏洞,我希望能够正确处理此错误并将其重定向到我们的一个自定义错误页面,或者至少阻止服务器像在错误信息.

除了查看IIS中网站的.NET错误页面和错误页面之外,我还尝试在global.asax的Application_Error方法中执行某些操作.在那里我可以看到状态代码是500而WebEventCode是System.Web.Management.WebEventCodes.RuntimeErrorViewStateFailure,但我不能做Response.Redirect或Server.Transfer那里因为我得到"Response.Redirect无法调用在页面回调中." 例外.我也尝试在web.config中将EnableViewStateMac设置为true,将ViewStateEncryptionMode设置为Always以查看是否会改变这些内容,但我仍然能够重新创建该问题.我很感激有人可能有的见解.

我从服务器返回的错误响应如下所示:

0|/*DX*/({'generalError':'Invalid viewstate. \r\n\tClient IP: 127.0.0.1\r\n\tPort: 51510\r\n\tReferer: https://localhost/-mysettings.aspx\r\n\tPath: /Default.aspx\r\n\tUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1\r\n\tViewState: /wEPDwUKMjA1OTAyNzk1MWQYBAUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFjQFQmN0bDAxJG1haW5Db250ZW50JGN0bDAwJGNwQWRtaW5pc3RyYXRpb25TZXR0aW5ncyRidG5DaGFuZ2VQYXNzd29yZAU/Y3RsMDEkbWFpbkNvbnRlbnQkY3RsMDAkY3BBZG1pbmlzdHJhdGlvblNldHRpbmdzJGJ0bkVkaXRQaWN0dXJlBT9jdGwwMSRtYWluQ29udGVudCRjdGwwMCRjcEFkbWluaXN0cmF0aW9uU2V0dGluZ3MkYnRuU2F2ZUNoYW5nZXMFQmN0bDAxJG1haW5Db250ZW50JGN0bDAwJGNwQWRtaW5pc3RyYXRpb<ScRiPt>alert(1)</ScRiPt>25TZXR0aW5ncyRjYlNpdGVDb3VudHJ5JERERAU8Y3RsMDEkbWFpbkNvbnRlbnQkY3RsMDAkY3BBZG1pbmlzdHJhdGlvblNldHRpbmdzJEFTUHhCdXR0b24zBV9jdGwwMSRtYWluQ29udGVudCRjdGwwMCRjcEFkbWluaXN0cmF0aW9uU2V0dGluZ3MkdXNlckFkZHJlc3MkcG5sQWRkcmVzcyRjYlNlYXJjaGFibGVBZGRyZXNzJERERAU8Y3RsMDEkbWFpbkNvbnRlbnQkY3RsMDAkY3BBZG1pbmlzdHJhdGlvblNldHRpbmdzJEFTUHhCdXR0b24yBT9jdGwwMSRtYWluQ29udGVudCRjdGwwMCRjcEFkbWluaXN0cmF0aW9uU2V0dGluZ3Mk...'})

Answer 1

我能够提出一个可行的解决方案.它并不完美但完成工作并阻止javascript出现在服务器响应中.我基本上只是清除当前错误并输出我自己的自定义响应.我将以下代码放在Global.asax的Application_Error方法中:

//Handle view state manipulation
HttpApplication httpApp = this.Context.ApplicationInstance;
HttpException httpEx = httpApp.Server.GetLastError() as HttpException;
if (httpEx != null)
{
    if (
        httpEx.WebEventCode == System.Web.Management.WebEventCodes.AuditInvalidViewStateFailure
        ||
        httpEx.WebEventCode == System.Web.Management.WebEventCodes.InvalidViewState
        ||
        httpEx.WebEventCode == System.Web.Management.WebEventCodes.InvalidViewStateMac
        ||
        httpEx.WebEventCode == System.Web.Management.WebEventCodes.RuntimeErrorViewStateFailure
        )
    {
        HttpContext.Current.ClearError();
        Response.Write("Error: An invalid viewstate has been detected (WebEventCode: " + httpEx.WebEventCode.ToString() + ").");
    }
}