Rule Definition
When web pages have a large amount of post data it can potentially lead to exhaustion of resources even with lesser number of sessions/calls.
Attackers can hence make possible Denial of Service with less number of requests.
The default limit for the following client side dictionaries is 1000 but changing them to a higher number poses a security risk.
Remediation
Never change the maxHttpCollectionKeys to more than , X being the customizable limit
Violation Code Sample
...
<appSettings>
<add key="aspnet:MaxHttpCollectionKeys" value="21474836" />
</appSettings>
...
Fixed Code Sample
...
<appSettings>
<add key="aspnet:MaxHttpCollectionKeys" value="<less than 1000>" /> //fixed
</appSettings>
...
OR
Do not specify MaxHttpCollectionKeys at all
Reference
https://docs.microsoft.com/en-us/previous-versions/aspnet/hh975440(v=vs.120)?redirectedfrom=MSDN
https://cwe.mitre.org/data/definitions/730.html
Related Technologies
Technical Criterion
Efficiency - Memory, Network and Disk Space Management
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.