Parameter Manipulation attack on ASP.NET MVC web site

Most of the ASP.NET MVC web site security patterns I have seen are focused on stopping non-authenticated users from accessing the site, or non-authorised users from accessing methods.

These methods work really well to secure the site.

However, in developing an ASP.NET MVC web site I learned the hard way that the patterns in tutorial and training materials for ASP.NET MVC are prone to parameter manipulation attacks.

Luckily for me it was identified during a pen test, and could be fixed.

The problem is that most of the examples you see rely on passing record keys to methods. The user is authenticated, and is authorised to use the methods. The problem occurs when the user decides to manipulate the record keys - this calling a method with a record key that you did not provide them.

For example, if you have an EditUser method that accepts a user id as a key parameter. The method is called by a button on a page (say a search page), that posts the form with the key value in a field. The malicious user can save the web page to a local file, modify the key value, load the page into the current sessions browser window, and submit the form.

The anti-forgery token is valid, the user is valid, the user is authorised - however they are now viewing or editing a user they were not supposed to.

The ASP.NET MVC developer needs to be aware of this vulnerability, and re-check that the user has rights to the records they are viewing or editing when the parameters are returned.

This can be done by performing the authorisation check again, storing the valid values in session state, encrypting keys, or any other method you care to use, however you can not trust that the parameter has not been tampered with when you receive it!