📝 Mass Assignment Attack Flow

Injecting Unauthorized Parameters - OWASP API Security #6

flowchart TD A[👤 Attacker] -->|1. Analyze API request| B[🔍 Discovery Phase] B -->|2. Identify object fields| C[📋 User Model Schema] C -->|3. Craft malicious request| D[📤 POST /api/users/register] D -->|4. Include extra fields| E[🎯 {username, email, isAdmin: true}] E -->|5. Auto-bind properties| F[⚙️ Object Mapper] F -->|6. No field filtering| G[❌ Mass Assignment Vuln] G -->|7. Save to database| H[(💾 Database)] H -->|8. Privilege escalation| I[👑 Admin Account Created] I -->|9. Full system access| A style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff style B fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000 style C fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000 style D fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000 style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff style F fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff style H fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff style I fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff J[🔒 Defense:
Whitelist Properties] -.->|Only allow specific fields| F K[🛡️ Defense:
DTOs/ViewModels] -.->|Separate models| E L[⚙️ Defense:
Disable Auto-binding] -.->|Manual mapping| G style J fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000 style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000 style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000

📋 Attack Flow Breakdown

1 Schema Discovery: Analyze API responses or documentation to identify object properties.
GET /api/users/123 → {id, username, email, role, isVerified}
2 Test Sensitive Fields: Inject administrative or privileged fields.
POST /api/users {username: "hacker", isAdmin: true, role: "admin"}
3 Price Manipulation: Modify prices in e-commerce applications.
POST /api/orders {product_id: 5, quantity: 1, price: 0.01}
4 Account Hijacking: Change user IDs or ownership.
PUT /api/profile {userId: 999, verified: true}
5 Bypass Verification: Set email/phone verification flags.
PATCH /api/user {emailVerified: true, phoneVerified: true}
6 Privilege Escalation: Gain administrative or premium access.

🛡️ Defense Mechanisms

✅ Use DTOs (Data Transfer Objects):
Create separate models for API input that only include allowed fields.
class UserRegistrationDTO { username, email, password }
✅ Whitelist Allowed Properties:
Explicitly define which fields can be mass-assigned.
User.create(params.permit(:username, :email, :password)) (Rails)
✅ Disable Auto-Binding:
Avoid automatic object mapping from request body.
Manual validation: user.name = req.body.name (NOT user = req.body)
✅ Mark Sensitive Fields as Read-Only:
Prevent modification of critical properties.
@ReadOnly or private setters for isAdmin, role, userId
✅ Schema Validation:
Validate input against strict schemas (JSON Schema, OpenAPI).
additionalProperties: false in JSON Schema
✅ Use ORM Protections:
Leverage built-in protections in ORMs.
Sequelize: paranoid mode, TypeORM: @Column options