Third-party cyber evaluations involving OpenAI models
openai.com·14h ago
Cloud & Infrastructure
Google Cloud Blog·May 25·5 min read
Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability
TL;DR
KnowledgeDeliver, a Japanese Learning Management System, contained a critical vulnerability where identical hardcoded ASP.NET machine keys were shared across all customer deployments. Mandiant discovered that attackers could exploit ViewState deserialization—a process where encrypted web session data is decoded—to achieve unauthenticated remote code execution.
✦ Why It Matters
Engineers must avoid hardcoding cryptographic keys in configuration files and ensure unique keys per deployment to prevent mass exploitation.
Key Takeaways
- Rotate machine keys to ensure unique encryption for each deployment.
- Monitor application logs for signs of ViewState exploitation.
- Restrict LMS access to known organizational IP addresses.
- Investigate any unauthorized changes to web application files.
How It Works
The vulnerability arises from the use of identical machine keys in the web.config file across different KnowledgeDeliver installations. This allows an attacker to craft malicious ViewState payloads that the server can deserialize, leading to remote code execution.