Rank: Member
Joined: 2/21/2007(UTC)
Posts: 1,113
|
I'm seeing a lot of this error today -- goes back several hours. Anyone ever seen this one?
Invalid length for a Base-64 char array.[ at System.Convert.FromBase64String(String s) at System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) at System.Web.UI.ObjectStateFormatter.System.Web.UI.IStateFormatter.Deserialize(String serializedState) at System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState) at System.Web.UI.HiddenFieldPageStatePersister.Load() ] |
|
|
|
|
|
|
Rank: Member
Joined: 11/5/2003(UTC)
Posts: 2,136
Was thanked: 1 time(s) in 1 post(s)
|
My guess is that someone is trying to post fake pages to your site with invalid data in one of the ASP.NET hidden fields (like ViewState or EventValidation). |
|
|
|
|
|
|
Rank: Member
Joined: 2/21/2007(UTC)
Posts: 1,113
|
Interesting -- anything I should be concerned about - or do something about? |
|
|
|
|
|
|
Rank: Member
Joined: 8/1/2007(UTC)
Posts: 310
|
This seems to be more of an exception to me. Looks like an index of a character array is being accessed which does not exist. Does it say anything more like the page name or the assembly name, etc? |
Thanks,
Satya
support @ bayquel.net
Work: +1 803 883 3226 |
|
|
|
|
|
Rank: Member
Joined: 8/1/2007(UTC)
Posts: 310
|
I just noticed that we use Base64 strings in the Cryptography class. Best you can do to figure out what is causing the error is to add some logging statements to the core project, recompile it and then replace your existing core dll. That will tell you exactly what operation is throwing this error. However, this is definitely an exception within the BV code base and not an attack as Any suggested.
The cryptography classes are primary used to encrypt/decrypt user account, credit card and user session ID related information. |
Thanks,
Satya
support @ bayquel.net
Work: +1 803 883 3226 |
|
|
|
|
|
Rank: Member
Joined: 11/5/2003(UTC)
Posts: 2,136
Was thanked: 1 time(s) in 1 post(s)
|
Originally Posted by: "birdsafe" 
Interesting -- anything I should be concerned about - or do something about?
I would not worry too much about it. It looks like ASP.NET is catching it and rejecting the bad data. If you wanted to know more about the request, you could add some code to the Application_Error method in globabl.asax (I'm guessing that that is the method that is logging the error). For example, you could log the encoded versions of all the posted form fields in the request after stripping out any potential SQL injections. |
|
|
|
|
|
|
Rank: Member
Joined: 11/5/2003(UTC)
Posts: 2,136
Was thanked: 1 time(s) in 1 post(s)
|
Originally Posted by: "Satya Vani"
The cryptography classes are primary used to encrypt/decrypt user account, credit card and user session ID related information.
I don't know how you got there. There is no encryption or decryption going on here. System.Web.UI.HiddenFieldPageStatePersister is used to deserialize the ASP.NET hidden fields in a post, and "Invalid length for a Base-64 char array" is the first check that the base-64 decoder performs (not decrypter). This error Joe reported literally means that one of the ASP.NET hidden fields in the post was of the wrong length to be a valid base-64 encoded character string. On my own site I often see this error when someone tries to post a page with an SQL injection in one of the hidden field. I suspect they know that it will cause the error shown here and hope that I will try to put the troublesome field into my log table using dynamic SQL (thus invoking the injection). I don't. But I do send myself an email so I see what they tried. |
|
|
|
|
|
|
Rank: Member
Joined: 8/1/2007(UTC)
Posts: 310
|
The reason I got there was because the user passwords and SessionIDs are being encrypted and decrypted using the Cryptography class. But I spoke too early. I missed the HiddenFieldPageStatePersister.
I definitely doubt if its SQL injection. For ASP.net it means the viewstate value sent to the browser is not the value the browser is sending back. This should ideally be a viewstate error. |
Thanks,
Satya
support @ bayquel.net
Work: +1 803 883 3226 |
|
|
|
|
|
Rank: Member
Joined: 8/1/2007(UTC)
Posts: 310
|
But yes, as Andy said, there is nothing to worry about. |
Thanks,
Satya
support @ bayquel.net
Work: +1 803 883 3226 |
|
|
|
|
|
Forum Jump
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.