sc-mass-assignment

SC: Mass Assignment / Over-Posting

Purpose

Detects mass assignment vulnerabilities where HTTP request body fields are bound directly to data models without field filtering, allowing attackers to set fields they should not have access to (e.g., isAdmin, role, price, verified). Covers framework-specific patterns across all major web frameworks.

Activation

Called by sc-orchestrator during Phase 2 when web frameworks with model binding are detected.

Phase 1: Discovery

Keyword Patterns to Search

"req.body", "request.body", "request.POST", "request.data",
"@RequestBody", "[FromBody]", "$request->all()",
"Model.create(", "Model.update(", "Object.assign(",
"fillable", "guarded", "attr_accessible",
"ModelForm", "Serializer", "DTO"

Vulnerability Patterns

Node.js/Express:

// VULNERABLE: Spread all body fields into create
app.post('/users', async (req, res) => {
  const user = await User.create(req.body);
  // If body = { name: "hacker", email: "...", role: "admin" }
  // Attacker becomes admin!
});

// SAFE: Pick only allowed fields
app.post('/users', async (req, res) => {
  const user = await User.create({
    name: req.body.name,
    email: req.body.email
  });
});

Django:

# VULNERABLE: ModelForm without fields restriction
class UserForm(ModelForm):
    class Meta:
        model = User
        fields = '__all__'  # Includes is_staff, is_superuser!

# SAFE: Explicit field list
class UserForm(ModelForm):
    class Meta:
        model = User
        fields = ['name', 'email', 'bio']

Laravel:

// VULNERABLE: No $fillable or $guarded
class User extends Model {
    // All fields are mass-assignable!
}
$user = User::create($request->all());

// SAFE: Define fillable fields
class User extends Model {
    protected $fillable = ['name', 'email'];
}

Spring Boot:

// VULNERABLE: Binding all request params to model
@PostMapping("/users")
public User createUser(@ModelAttribute User user) {
    return userRepository.save(user);
}

// SAFE: Use DTO
@PostMapping("/users")
public User createUser(@RequestBody CreateUserDTO dto) {
    User user = new User();
    user.setName(dto.getName());
    user.setEmail(dto.getEmail());
    return userRepository.save(user);
}