Potential IP Addresses Found in the Viewstate

Summary

Potential IP addresses were found to be serialized in the ViewState field.

An attacker can study the application's state management logic for possible vulnerabilities, and if your application stores application-critical information in the ViewState (e.g., IP addresses), it will also be revealed.

Solution

Reduce the chance of someone intercepting the information stored in the ViewState by encrypting it.

Risk

Medium

References

• https://www.valencynetworks.com/kb/how-to-encrypt-viewstates-in-dotnet.html
• https://docs.microsoft.com/en-us/troubleshoot/aspnet/troubleshooting-view-state-is-invalid-error