VIEW STATE, THE UNPATCHABLE IIS FOREVER DAY BEING ACTIVELY EXPLOITED

Summary from the TLDR InfoSec newsletter

This blog post discusses why the ViewState vulnerability is not used for exploits despite being around for a long time and explains how it can be done on a fully patched Microsoft Exchange 2019 host. It explains how to exploit view state vulnerabilities and the process of resetting compromised machine keys in IIS. It also highlights the risks associated with resetting machine keys and provides steps to regenerate them based on whether they were automatically generated or static.