News for hackers. Stuff that matters.

A comment on CVE-2020-0688: Remote Code Execution on Microsoft Exchange Server. Parent comment

Re:CVE-2020-0688: Remote Code Execution on Microsoft Exchang... by geocar on Wednesday February 26, 2020 @03:08PM (#22426786)
Seaside[1] and (IIRC) arc[2] both do this too.

My understanding was that __ViewState was intended to be encrypted in production by setting something in machine.config[3].

[1]: https://en.wikipedia.org/wiki/Seaside_(software)

[2]: http://arclanguage.org/

[3]: https://docs.microsoft.com/en-us/previous-versions/dotnet/ar...

[ Parent | on HN ]
Re:CVE-2020-0688: Remote Code Execution on Microsoft Exchang... by needusername on Wednesday February 26, 2020 @06:27PM (#22428634)
Hell no. Seaside captures the state server side, stores it under an id and sends that id to the client. The client sends the id of the state snapshot back to the server.
[ Parent | on HN ]