Microsoft warns that attackers are deploying malware in ViewState code injection assaults utilizing static ASP. NET machine keys discovered on-line.
As Microsoft Risk Intelligence consultants not too long ago found, some builders use ASP.NET validationKey and decryptionKey keys (designed to guard ViewState from tampering and data disclosure) discovered on code documentation and repository platforms in their very own software program.
Nonetheless, menace actors additionally use machine keys from publicly out there sources in code injection assaults to create malicious ViewStates (utilized by ASP.NET Internet Varieties to manage state and protect pages) by attaching crafted message authentication code (MAC).
When loading the ViewStates despatched by way of POST requests, the ASP.NET Runtime on the focused server decrypts and validates the attackers’ maliciously crafted ViewState information as a result of it makes use of the precise keys, hundreds it into the employee course of reminiscence, and executes it.
This permits them to execute code remotely on the IIS server and deploy extra malicious payloads.
In a single occasion noticed in December 2024, an unattributed attacker used a publicly recognized machine key to ship the Godzilla post-exploitation framework, which comes with malicious command execution and shellcode injection capabilities, to a focused Web Info Providers (IIS) internet server.
“Microsoft has since recognized over 3,000 publicly disclosed keys that may very well be used for all these assaults, that are known as ViewState code injection assaults,” the firm stated on Thursday.
“Whereas many beforehand recognized ViewState code injection assaults used compromised or stolen keys which can be typically offered on darkish internet boards, these publicly disclosed keys might pose a better danger as a result of they’re out there in a number of code repositories and will have been pushed into growth code with out modification.”
To dam such assaults, Microsoft recommends builders securely generate machine keys, not use default keys or keys discovered on-line, encrypt machineKey and connectionStrings components to dam entry to plaintext secrets and techniques, improve apps to make use of ASP.NET 4.8 to allow Antimalware Scan Interface (AMSI) capabilities, and harden Home windows Servers by utilizing assault floor discount guidelines similar to Block Webshell creation for Servers.
Microsoft additionally shared detailed steps for eradicating or changing ASP.NET keys within the internet.config configuration file utilizing both PowerShell or the IIS supervisor console and eliminated key samples from its public documentation to additional discourage this insecure follow.
“If profitable exploitation of publicly disclosed keys has occurred, rotating machine keys won’t sufficiently handle potential backdoors or persistence strategies established by a menace actor or different post-exploitation exercise, and extra investigation could also be warranted,” Redmond warned.
“Particularly, web-facing servers ought to be totally investigated and strongly thought of for re-formatting and re-installation in an offline medium in instances the place publicly disclosed keys have been recognized, as these servers are most liable to potential exploitation.”
