Captcha Vulnerability

[mtrujillo86]

5/22/2012 9:09:53 AM Error An error has occured at /Captcha.ashx?h=ping -c2 -i60 localhost&id=486008&sid=1&t=082819&w=250 Input string was not in a correct format.

Since we started receiving these hack attempts we have enabled our encryption key. The ID is now being encrypted, however when the user attempts to put malicious code in the URL the user receives the error back. We have debug=false and we built the all projects in release mode.

We need this fixed asap - Any ideas?

Input string was not in a correct format.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.FormatException: Input string was not in a correct format.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:


[FormatException: Input string was not in a correct format.]
System.Number.StringToNumber(String str, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean parseDecimal) +12636309
System.Number.ParseInt32(String s, NumberStyles style, NumberFormatInfo info) +224
CommerceBuilder.Web.CaptchaGenerator.ProcessRequest(HttpContext context) in C:\Users\mmtrujillo\Documents\Visual Studio 2010\Projects\AbleCommerce\CommerceBuilder.Web.UI\CaptchaGenerator.cs:36
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +625
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +270

[mouse_8b]

In your web.config, is Custom Errors set to "on"?

Code: Select all

<system.web>
		<customErrors mode="On" defaultRedirect="~/Errors/GeneralError.aspx">
			<error statusCode="404" redirect="~/Errors/PageNotFound.aspx" />
		</customErrors>

[mtrujillo86]

That fixed it. We had debug=false which I thought was suppose to not show any errors.

[mouse_8b]

I think that debug=false will put some extra text in the page for debugging, while customErrors will redirect to a completely different page on an error.