Microsoft warns that attackers are deploying malware in ViewState code injection assaults utilizing static ASP. NET machine keys discovered on-line.
As Microsoft Risk Intelligence specialists lately found, some builders use ASP.NET validationKey and decryptionKey keys (designed to guard ViewState from tampering and knowledge disclosure) discovered on code documentation and repository platforms in their very own software program.
Nonetheless, menace actors additionally use machine keys from publicly accessible sources in code injection assaults to create malicious ViewStates (utilized by ASP.NET Internet Kinds to manage state and protect pages) by attaching crafted message authentication code (MAC).
When loading the ViewStates despatched through POST requests, the ASP.NET Runtime on the focused server decrypts and validates the attackers’ maliciously crafted ViewState knowledge as a result of it makes use of the suitable keys, hundreds it into the employee course of reminiscence, and executes it.
This permits them to execute code remotely on the IIS server and deploy further malicious payloads.
In a single occasion noticed in December 2024, an unattributed attacker used a publicly identified machine key to ship the Godzilla post-exploitation framework, which comes with malicious command execution and shellcode injection capabilities, to a focused Web Info Companies (IIS) net server.
“Microsoft has since recognized over 3,000 publicly disclosed keys that might be used for most of these assaults, that are known as ViewState code injection assaults,” the firm stated on Thursday.
“Whereas many beforehand identified ViewState code injection assaults used compromised or stolen keys which can be usually offered on darkish net boards, these publicly disclosed keys may pose the next danger as a result of they’re accessible in a number of code repositories and will have been pushed into growth code with out modification.”
To dam such assaults, Microsoft recommends builders securely generate machine keys, not use default keys or keys discovered on-line, encrypt machineKey and connectionStrings components to dam entry to plaintext secrets and techniques, improve apps to make use of ASP.NET 4.8 to allow Antimalware Scan Interface (AMSI) capabilities, and harden Home windows Servers through the use of assault floor discount guidelines equivalent to Block Webshell creation for Servers.
Microsoft additionally shared detailed steps for eradicating or changing ASP.NET keys within the net.config configuration file utilizing both PowerShell or the IIS supervisor console and eliminated key samples from its public documentation to additional discourage this insecure observe.
“If profitable exploitation of publicly disclosed keys has occurred, rotating machine keys won’t sufficiently tackle doable backdoors or persistence strategies established by a menace actor or different post-exploitation exercise, and extra investigation could also be warranted,” Redmond warned.
“Particularly, web-facing servers must be absolutely investigated and strongly thought of for re-formatting and re-installation in an offline medium in circumstances the place publicly disclosed keys have been recognized, as these servers are most prone to doable exploitation.”