📝 Mass Assignment Attack Flow
Injecting Unauthorized Parameters - OWASP API Security #6
flowchart TD
A[👤 Attacker] -->|1. Analyze API request| B[🔍 Discovery Phase]
B -->|2. Identify object fields| C[📋 User Model Schema]
C -->|3. Craft malicious request| D[📤 POST /api/users/register]
D -->|4. Include extra fields| E[🎯 {username, email, isAdmin: true}]
E -->|5. Auto-bind properties| F[⚙️ Object Mapper]
F -->|6. No field filtering| G[❌ Mass Assignment Vuln]
G -->|7. Save to database| H[(💾 Database)]
H -->|8. Privilege escalation| I[👑 Admin Account Created]
I -->|9. Full system access| A
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style D fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style I fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
J[🔒 Defense:
Whitelist Properties] -.->|Only allow specific fields| F
K[🛡️ Defense:
DTOs/ViewModels] -.->|Separate models| E
L[⚙️ Defense:
Disable Auto-binding] -.->|Manual mapping| G
style J fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Schema Discovery: Analyze API responses or documentation to identify object properties.
GET /api/users/123 → {id, username, email, role, isVerified}
2
Test Sensitive Fields: Inject administrative or privileged fields.
POST /api/users {username: "hacker", isAdmin: true, role: "admin"}
3
Price Manipulation: Modify prices in e-commerce applications.
POST /api/orders {product_id: 5, quantity: 1, price: 0.01}
4
Account Hijacking: Change user IDs or ownership.
PUT /api/profile {userId: 999, verified: true}
5
Bypass Verification: Set email/phone verification flags.
PATCH /api/user {emailVerified: true, phoneVerified: true}
6
Privilege Escalation: Gain administrative or premium access.
🛡️ Defense Mechanisms
✅ Use DTOs (Data Transfer Objects):
Create separate models for API input that only include allowed fields.
class UserRegistrationDTO { username, email, password }
✅ Whitelist Allowed Properties:
Explicitly define which fields can be mass-assigned.
User.create(params.permit(:username, :email, :password)) (Rails)
✅ Disable Auto-Binding:
Avoid automatic object mapping from request body.
Manual validation: user.name = req.body.name (NOT user = req.body)
✅ Mark Sensitive Fields as Read-Only:
Prevent modification of critical properties.
@ReadOnly or private setters for isAdmin, role, userId
✅ Schema Validation:
Validate input against strict schemas (JSON Schema, OpenAPI).
additionalProperties: false in JSON Schema
✅ Use ORM Protections:
Leverage built-in protections in ORMs.
Sequelize: paranoid mode, TypeORM: @Column options