The one-click attack and ViewStateUserKey

A one-click attack consists in posting a malicious HTTP form to a known, vulnerable Web site. It is called "one-click" because it usually begins with an unaware victim clicking on an alluring link received through e-mail or found when navigating a crowded forum. By following the link, the user inadvertently triggers a remote process that ends up submitting the malicious form to a site. To be successful, a one-click attack requires certain background conditions:

• The first prerequisite is a social pretext that will lure the victim into clicking a hyperlink.
• The attacker also needs a Web site to host the page that launches the attack - but not always.
• A would-be attacker needs sufficient knowledge of the target application to construct request data, which the application will accept. Generally, this means that the attacker needs to know the URL of the vulnerable page, the name of every form field and query string parameter in the page, and what sort of value is expected for each of them.
• The site must be using cookies (better if persistent cookies) to implement single sign-on, and the attacker should have received a valid authentication cookie.
• Certain users of the site are involved in sensitive transactions.
• The attacker must have access to the target page.

The attacker is limited as to what parts of the victim's request he can control using this technique. The query string parameters and form fields are completely within the attacker's control, but cookies are out of reach. Some of the request headers, such as User-Agent, are also out of the attacker's reach, but others, such as Server and Referer, can be controlled to varying degrees. The only hint that the victim did not intend to submit the request is in the Referer field.

The industrial-strength solution to the problem of one-click attacks is to somehow prevent the attacker from being able to assemble request data that the server will accept. This is done by requiring a field in the request to contain an element of data that the attacker can't supply.

ViewStateUserKey is a string property of the System.Web.UI.Page class. The property helps you prevent one-click attacks by providing additional input to create the hash value that defends the view state against tampering. In other words, ViewStateUserKey makes it much harder for hackers to use the content of the client-side view state to prepare malicious posts against the site.

Read Eric Rachner's article One-click Attack in more detail. Also read Dino Esposito's article Take Advantage of ASP.NET Built-in Features to Fend Off Web Attacks on the most common types of Web attacks.