News for hackers. Stuff that matters.

A comment on CVE-2020-0688: Remote Code Execution on Microsoft Exchange Server. Parent comment

Re:CVE-2020-0688: Remote Code Execution on Microsoft Exchang... by sebazzz on Wednesday February 26, 2020 @05:25PM (#22428081)
I'm suprised this attack is even possible. Disabling of the viewstate MAC validation is disallowed, since a while [1]. However, MAC validation is apparently circumvented because the ViewStateUserKey is known.

[1]: https://devblogs.microsoft.com/aspnet/farewell-enableviewsta...

[ Parent | on HN ]

There are no comments on this comment yet.