Request Validation Disabled

csharp.request_validation_disabled

Severity

high

Resource

Misconfiguration

Language

CSharp

Description

Request validation is a security feature in ASP.NET and ASP.NET MVC that helps prevent potentially dangerous content from being processed by checking user input for malicious content by default. Disabling request validation increases the risk of injection attacks.

Rationale

ASP.Net

Consider the following scenario where an XSS protection header might be disabled, leaving the application vulnerable:

<configuration>
   <system.web>
      <pages validateRequest="false" />
   </system.web>
</configuration>

In this example, the application is vulnerable to Cross-site Scripting (XSS) attacks because the protection provided by ASP.NET was disabled globally.

Also, this can be disabled locally. See this code:

<%@ Page Title="" Language="C#" ValidateRequest="false" %>

In this ASP.NET Web Forms example, request validation is disabled on a specific page level, making that page susceptible to XSS, as it will not automatically filter potentially harmful inputs.

ASP.Net MVC

In an ASP.NET MVC application, request validation can be disabled at the action level using an attribute, potentially exposing the application to XSS:

[HttpPost]
[ValidateInput(false)]
public ActionResult Edit(string comment)
{
    if (ModelState.IsValid)
    {
        // Processing logic
    }
    return View(comment);
}

In this MVC example, the [ValidateInput(false)] attribute disables request validation for this specific action, allowing the input comment to potentially include malicious script tags if not properly handled.

Remediation

ASP.Net

To fix the vulnerable code shown before, make sure that the XSS protection header is NOT disabled:

<configuration>
   <system.web>
      <pages validateRequest="true" />
   </system.web>
</configuration>

In addition, consider encoding input potentially taken from untrusted input before inserting in HTML code, according to the context in the HTML content:

ASP.Net MVC

Additionally, in MVC, ensure request validation is enabled unless there’s a specific, well-justified need to disable it, and apply robust validation and encoding where necessary.

References

CWE-554 : ASP.NET Misconfiguration: Not Using Input Validation Framework.