Hown I can test "Microsoft ASP.NET Forms Authentication Bypass" in ASP.Net 4.0.30319

Question

I searched in google for "ASP.Net 4.0.30319 vulnerability " keyword. finally,I found "Microsoft ASP.NET Forms Authentication Bypass" in below link:

http://dl.packetstormsecurity.net/1203-exploits/SA-20120328-1.txt

but I don't know how to penetration test this vulnerability. otherwords , if someone get me one application that implemented by ASP.Net 4.0.30319 ,I can't proof exists this vulnerability.

My question is how to prove the existence of this vulnerability in a ASP.NET Applications? Do the necessary steps to patch this vulnerability has done by programer?

Answer 1

I had this same question, and after a bit more digging, I found it.

The PoC should be here (as said in the file you linked in the question):

Furthermore, SEC Consult created a PoC video which can be found here: https://www.sec-consult.com/files/20120328-1_asp.net_authentication_bypass_MS11_100.mp4

However, this link is broken. Luckily, a single copy was archived on the Wayback Machine back in 2012, where the video can be successfully viewed, demonstrating how the exploit works!

https://web.archive.org/web/20120612214447/https://www.sec-consult.com/files/20120328-1_asp.net_authentication_bypass_MS11_100.mp4

Answer 2

First, please review the corresponding MS bulletin on this vulnerability (MS11-100). Which you could have found by googling the CVE. I would recommend reading through this document, googling anything you do not understand and then checking the patch and versions depending on your operating system.

If the corresponding patches are installed on the machine, this would indicate that it is not vulnerable. If you are using something like nessus, you can prove it exists, there seems to be a nessus plugin to check for this (plugin id 57414).

Also, the link you provided has Proof of concept code you can utilize.

For your last question, I am not intimately familiar with this, but from reading through these links it is a vulnerable in the framework not in the way the code is authored, so if you are using a patched version of the framework this issue should not be present, but please read the details yourself to verify.