ViewState is not Encrypted

Description

The ViewState, a hidden form input in ASP.NET pages, automatically persists information and application data specific to a page. If the ViewState is not encrypted, its contents can be easily viewed by anyone, potentially exposing sensitive information.

Recommendation

To enhance security, avoid storing sensitive values in the ViewState and enable encryption for it. For the entire application, enable ViewState encryption by adding the specified configuration to the Web.Config file under the system.web node:

<system.web>
  <pages viewStateEncryptionMode="Always" />
</system.web>

Alternatively, for specific pages, enable encryption by adding the provided directive at the top of each page:

<%@Page ViewStateEncryptionMode="Always" %>

References

• CWE-16
• CWE-200
• CAPEC-118
• OWASP 2021-A1
• OWASP 2021-A5