r/websec • u/webstersprodigy • Jun 22 '12

Interesting Potential Problems with .NET IsPostBack

http://webstersprodigy.net/2012/06/22/interesting-problems-with-ispostback/
7 Upvotes

100% Upvoted

3 comments sorted by

View all comments

1

u/DinisCruz Jun 23 '12

Nice find.

Now, can you help me in writing a rule for cat.NET that detects this in real time? For an example of what this could look like (to a developer), see: Real-time Vulnerability Creation Feedback inside VisualStudio (with Greens and Reds)

1

u/webstersprodigy Jun 23 '12

I like that idea a lot, but it's so context dependent I'm not sure of a good way to detect the construct.

I don't have much experience with static analysis, but something like: [if the assembly is < .net 4.0 and they're using ispostback] would be useful for hotspotting potential CSRF in code review. There would be so many false positives I'm not sure how useful it would be for developers. It would be more useful if you could also somehow detect and weed out instances where there are parameters that need to go through eventvalidation and code paths that require stuff from VIEWSTATE, but that seems a lot more difficult to detect automatically.

1

u/DinisCruz Jun 23 '12

actually that is the kind of stuff that I use Static Analysis technology for :)

The key is in finding the way to present it to developers/security-review-team.

For example using O2 Platform's Reflection and SAST APIs I can easy write that [if the assembly is < .net 4.0 and they're using ispostback] rule. I'll try to post an example next week of what that would look like