VNX-554: ASP.NET Misconfiguration: Not Using Input Validation Framework

ASP.NET request validation is switched off: ValidateRequest="false" on a page, validateRequest="false" or requestValidationMode="2.0" in Web.config, or [ValidateInput(false)] on an MVC action or controller.

Field	Value
Rule ID	`VNX-554`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C#, XML
CWE	CWE-554
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`aspnet` `request-validation` `cwe-554`
Source	`internal/sast/rules/vnx-554.rego`

Overview

VNX-554 maps to CWE-554: ASP.NET Misconfiguration: Not Using Input Validation Framework. It reports the settings that turn off ASP.NET request validation, the framework’s built-in rejection of markup and script in request input.

Why This Matters

Request validation is a coarse filter, but it stops the plain <script> payloads that reach pages which forget to encode their output. Turning it off for a page, a controller or the whole site removes that net everywhere it applied, usually to let one rich-text field through.

What Gets Flagged

<%@ Page Language="C#" ValidateRequest="false" CodeBehind="Comment.aspx.cs" Inherits="Site.Comment" %>

<httpRuntime targetFramework="4.8" requestValidationMode="2.0" />
<pages validateRequest="false" />

[HttpPost]
[ValidateInput(false)]
public ActionResult Create(string title, string body) { ... }

Not flagged: validation left on or set to true, requestValidationMode 4.0 or 4.5, the field-level opt-outs [AllowHtml] and Request.Unvalidated, ASP.NET Core (it has no request validation), XML and <%-- --%> comments, C# comments and string literals.

Remediation

Remove ValidateRequest="false", validateRequest="false", requestValidationMode="2.0" and [ValidateInput(false)].
Where one field must accept markup, allow it on that field only with [AllowHtml] and sanitise it with an HTML sanitiser.
Encode all output (<%: %>, @ in Razor, HttpUtility.HtmlEncode); request validation does not replace it.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-554
// nosec vnx-554

Or record an ignore rule: vulnetix ignore add --rule vnx-554 --reason "...". See Suppressing findings.