mass assignment | Security Notes

Last updated 26 days ago

Mass Assignment is a security vulnerability that arises when an application automatically assigns user input values to an object's properties without properly controlling which attributes are accessible for modification. This can result in unauthorized or unintended changes to sensitive data, such as modifying attributes that should only be editable by an administrator or specific users.

How it works:

An application typically uses an object to represent entities (e.g., a user, product, or account) with various attributes (e.g., user.email, product.stock, account.wallet).
When a user submits a request (usually a PUT or PATCH request), the application might directly map the user-supplied data to the object's properties.
If the application does not validate or restrict which attributes can be modified, the user could potentially modify properties they shouldn't have access to (e.g., product.title, account.wallet, account.type).

Scenario 1: Booking an Appointment for a Consultant

An application allows users to book appointments for a consultant by selecting available time slots.

Request Example (Normal Booking):

An attacker realizes they can modify the endDate to extend the appointment for years, thereby blocking future slots.

Request Example (Malicious Modification):

By exploiting this, the attacker could fully block the consultant’s calendar for years. This is a subtle vulnerability, often overlooked because the system doesn’t properly validate the date range or check for unrealistic future times.

Scenario 2: Changing User Account Type

An attacker may gain unauthorized access to higher privileges by manipulating account-related parameters. In this case, the attacker finds that the AccountType property is reflected in the response but is not protected in the API.

Request Example (Normal Profile Update):

Response:

Exploit: Modifying Account Type

the attacker sends a request including the AccountType field.

Request Example (Malicious Modification):

Response:

As a result, the attacker successfully changes their account type to admin without any validation, potentially gaining higher privileges such as administrative access.

Mass Assignment Testing Steps

Target Vulnerabilities:

Account Registration
Unauthorized Access to Organizations
Reset Password
Login
Change Email
Change Username

Account Registration Request:

Basic Request:

Mass Assignment Variations:

Try with admin key:
Try with ADMIN key:
Try with isadmin key:
Try with ISADMIN key:
Try with Admin key:
Try with role set to admin:
Try with role set to ADMIN:
Try with role set to administrator:
Try with user_priv set to administrator:
Try with user_priv set to admin:
Try with admin as integer:

Unauthorized Access to Organizations:

Register with Organization:

Finding Variables in Documentation:

Fuzzing Unknown Variables:

Perform actions in the web application, intercept requests, and locate additional headers or parameters.

Automating Mass Assignment Attacks:

Use Arjun and Burp Suite Intruder:

Last updated 26 days ago