Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. An ASP.NET request that has lots of form keys, files, or JSON payload members fails with an exception

An ASP.NET request that has lots of form keys, files, or JSON payload members fails with an exception

View products that this article applies to.

Summary

Microsoft security update MS11-100 limits the maximum number of form keys, files, and JSON members to 1000 in an HTTP request. Because of this change, ASP.NET applications reject requests that have more than 1000 of these elements. HTTP clients that make these kinds of requests will be denied, and an error message will appear in the web browser. The error message will usually have an HTTP 500 status code. This new limit can be configured on a per-application basis. Please see the "Resolution" section for configuration instructions.


↑ Back to the top

Symptoms

ASP.NET requests that have lots of form keys, files, or JSON payload receive an error response from the server. The Application log on the server has a Warning entry with a Source that is a specific version of ASP.NET, and an Event ID of 1309. The event log contains one of the following messages:


Message 1:
Application information:
Application domain: /LM/W3SVC/1/ROOT/<App Domain>
Trust level: Medium
Application Virtual Path: <VDIR Path>
Application Path: <App Path>
Machine name: <Machine Name>
Process information:
Process ID: 0001
Process name: w3wp.exe
Account name: IIS APPPOOL\DefaultAppPool

Exception information:
Exception type: HttpException
Exception message: The URL-encoded form data is not valid.
at System.Web.HttpRequest.FillInFormCollection()
at System.Web.HttpRequest.get_Form()
at System.Web.HttpRequest.get_HasForm()
at System.Web.UI.Page.GetCollectionBasedOnMethod(Boolean dontReturnNull)
at System.Web.UI.Page.DeterminePostBackMode()
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)


Message 2:
Application information:
Application domain: /LM/W3SVC/1/ROOT/<App Domain>
Trust level: Medium
Application Virtual Path: <VDIR Path>
Application Path: <App Path>
Machine name: <Machine Name>

Process information:
Process ID: 0001
Process name: w3wp.exe
Account name: IIS APPPOOL\DefaultAppPool

Exception information:
Exception type: InvalidOperationException
Exception message: Operation is not valid due to the current state of the object.
at System.Web.HttpRequest.FillInFilesCollection()
at System.Web.HttpRequest.get_Files()
at FileUpload.Page_Load(Object sender, EventArgs e)
at System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e)
at System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e)
at System.Web.UI.Control.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint

Message 3:
Application information:
Application domain: /LM/W3SVC/1/ROOT/<App Domain>
Trust level: Medium
Application Virtual Path: <VDIR Path>
Application Path: <App Path>
Machine name: <Machine Name>

Process information:
Process ID: 0001
Process name: w3wp.exe
Account name: IIS APPPOOL\DefaultAppPool

Exception information:
Exception type: InvalidOperationException
Exception message: Operation is not valid due to the current state of the object.
at System.Web.Script.Serialization.JavaScriptObjectDeserializer.DeserializeDictionary(Int32 depth)
at System.Web.Script.Serialization.JavaScriptObjectDeserializer.DeserializeInternal(Int32 depth)
at System.Web.Script.Serialization.JavaScriptObjectDeserializer.BasicDeserialize(String input, Int32 depthLimit, JavaScriptSerializer serializer)
at System.Web.Script.Serialization.JavaScriptSerializer.Deserialize(JavaScriptSerializer serializer, String input, Type type, Int32 depthLimit)
at System.Web.Script.Serialization.JavaScriptSerializer.DeserializeObject(String input)
at Failing.Page_Load(Object sender, EventArgs e)
at System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e)
at System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e)
at System.Web.UI.Control.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)


The IIS log file shows an entry that resembles the following:
2011-01-01 00:00:00 ::1 POST /machine/default.aspx - 80 - ::1 - 500 0 0 187




↑ Back to the top

Cause

The Microsoft security update that security bulletin MS11-100 addresses changes the default maximum number of form keys, files, and JSON members that ASP.NET will accept in a request to 1,000. This change was made to address the Denial of Service vulnerability that the Microsoft security bulletin MS11-100 documents.


↑ Back to the top

Resolution

Applications that reach this limit for form keys or files can modify the ASP.NET appSetting aspnet:MaxHttpCollectionKeys, as shown below in an ASP.NET application’s configuration file. This setting addresses error message 1 and error message 2 from the "Symptoms" section. 
<configuration>
<appSettings>
<add key="aspnet:MaxHttpCollectionKeys" value="1000" />
</appSettings>
</configuration>


Note
If you are using ASP.NET 1.1 on an x86-based system, the setting is adjusted by adding a DWORD value to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ASP.NET\1.1.4322.0\MaxHttpCollectionKeys
If you are using ASP.NET 1.1 on an x64-based system, the setting is adjusted by adding a DWORD value to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ASP.NET\1.1.4322.0\MaxHttpCollectionKeys



Applications that hit this limit for JSON payloads can modify the ASP.NET appSetting aspnet:MaxJsonDeserializerMembers, as shown below in an ASP.NET application’s configuration file. This setting addresses error message 3 from the "Symptoms" section. 
<configuration>
<appSettings>
<add key="aspnet:MaxJsonDeserializerMembers" value="1000" />
</appSettings>
</configuration>



Note Increasing this value above the default setting increases the susceptibility of your server to the Denial of Service vulnerability that is discussed in security bulletin MS11-100.


↑ Back to the top

References

For more information about security bulletin MS11-100, see the following TechNet article:
Microsoft Security Bulletin MS11-100 - Critical
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
2638420 MS11-100: Vulnerability in the .NET Framework could allow elevation of privilege: December 29, 2011

↑ Back to the top

Applies to:

↑ Back to the top

Keywords: kb, atdownload, kbbug, kbexpertiseinter, kbfix, kblangall, kbmustloc, kbsecbulletin, kbsecreview, kbsecurity, kbsecvulnerability, kbsurveynew

↑ Back to the top

Article Info
Article ID : 2661403
Revision : 4
Created on : 6/4/2018
Published on : 6/4/2018
Exists online : False
Views : 232