Yes. If attackers obtain a publicly disclosed or reused ASP.NET machineKey, they can forge a Web Forms ViewState payload that ASP.NET accepts and execute code in the IIS worker process. ViewState is not dangerous by itself; the exposure comes from leaked or predictable cryptographic keys and can lead to remote code execution on the server.
Why an exposed machineKey is a server-level risk
ASP.NET Web Forms places page state in a hidden ViewState field sent back to the server. The ValidationKey produces the message-authentication code (MAC) that proves the state was created by a trusted application. The DecryptionKey supports confidentiality when ViewState encryption is enabled. An attacker who has the correct fixed values can create state that passes both checks.
The critical condition is key disclosure or reuse: copying values from a public repository, sample configuration, documentation, or another compromised application gives an attacker the material needed to impersonate the application when it processes ViewState. Normal ViewState traffic without those keys does not provide the same capability.
How a ViewState code-injection attack works
- The attacker obtains the target application’s fixed
ValidationKeyand, where required, itsDecryptionKey. - Using those values, the attacker constructs a malicious ViewState object and computes the authentication data ASP.NET expects.
- The payload is submitted to a Web Forms endpoint in an HTTP POST, usually through the page’s hidden ViewState field.
- ASP.NET Runtime decrypts the field when encryption is enabled and validates its MAC. Microsoft describes this as successful processing “because the right keys are used.”
- The malicious object is loaded into the IIS worker-process memory and executed, giving the threat actor remote code-execution capability on the target web server.
This chain is why a key leak can turn an ordinary Web Forms endpoint into an initial execution path. The attack does not require changing the application’s source code; the forged state is accepted during normal request processing.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
What Microsoft observed
| Fact | What is established |
|---|---|
| Publicly disclosed keys | Microsoft Threat Intelligence reported more than 3,000 publicly disclosed ASP.NET machine keys in 2025. This is a count of exposed keys, not a count of confirmed victims. |
| Observed activity | Microsoft observed limited malicious activity in December 2024 by an unattributed actor using one publicly available static key. |
| Reported indicator window | The indicator was first seen from 2024-12-11 through 2024-12-19. |
| Payload | The activity reflectively loaded assembly.dll and the Godzilla post-exploitation framework. |
| Godzilla capabilities listed by Microsoft | Malicious command execution and shellcode injection. |
| Independent prevalence or victim total | Not stated by the official Microsoft reporting. |
Remediation for a single IIS server versus a web farm
| Deployment | Required key change | Important detail |
|---|---|---|
| Single server | Remove the fixed machineKey element so ASP.NET can use auto-generated, registry-backed values. |
This eliminates the exposed static values instead of replacing them with another manually copied pair. |
| Web farm | Generate new ValidationKey and DecryptionKey values and apply the same new values on every server in the farm. |
All nodes must share the coordinated replacement values; do not assign a different pair to each node. |
In either pattern, remove public or default keys and do not copy machine-key values from public sources. Treat any fixed value that appeared in a repository, sample, ticket, or other exposed location as compromised.
Protect the configuration and runtime
- Encrypt both the
machineKeyandconnectionStringssections inweb.configduring deployment so plaintext secrets are not left in the file. - Upgrade applications to ASP.NET 4.8. Microsoft identifies this version as the baseline for enabling AMSI integration and applying the relevant Windows attack-surface-reduction protections.
- Apply attack-surface-reduction rules that block web-shell creation. These controls add a server-side barrier if an application request is abused to drop a shell.
Detect exposed keys and suspicious configuration access
- Use the Microsoft Defender for Endpoint alert named
Publicly disclosed ASP.NET machine key
as an exposure signal. An alert indicates that a known-disclosed key is present; it does not by itself prove that code execution occurred. - Use Microsoft Sentinel analytics to look for related activity and monitor Windows Event ID 4663 for suspicious access to configuration files.
- Prioritize internet-facing IIS servers, Web Forms applications, and farms that replicate a single fixed
machineKeyacross nodes.
What to do when exploitation may have occurred
Key rotation is necessary but is not a complete incident response. If an attacker already used the forged ViewState path, changing the keys does not remove a web shell, modified application files, scheduled persistence, or other backdoor left on the host.
Quick Recap
Rank #4
Rank #2
- Start a forensic investigation of the exposed web-facing server and its application activity.
- Use the investigation to determine whether malicious ViewState requests, unexpected worker-process behavior, or post-exploitation tooling such as Godzilla are present.
- After evidence collection and incident handling, strongly consider taking the exposed web-facing server offline for reformatting and reinstallation, as Microsoft recommends when compromise is possible.
- Deploy newly generated or auto-generated machine-key values according to the single-server or farm model, then protect the configuration and apply the ASP.NET 4.8 and Windows attack-surface-reduction controls.
Operator checklist
- Search every IIS Web Forms deployment for a fixed
machineKey. - Remove values that came from public repositories, documentation, defaults, or another environment.
- For a farm, generate one new coordinated pair and place it on every node; for a single server, remove the fixed element.
- Encrypt
machineKeyandconnectionStringsinweb.config. - Upgrade to ASP.NET 4.8 and enable the applicable AMSI and web-shell-blocking attack-surface-reduction protections.
- Review Defender for Endpoint, Sentinel analytics, and Event ID 4663 configuration-file access.
- If compromise cannot be ruled out, investigate and plan an offline rebuild rather than relying on rotation alone.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
