Mass Assignment
HighMass Assignment
Definition
Mass Assignment is a vulnerability that occurs when an application automatically binds the values of an HTTP request to the fields of a data model or object without filtering which fields may be modified. An attacker can add extra fields to the request to change sensitive attributes such as role, status or price.
Impact
Privilege escalation (changing role to admin)Bypassing payment restrictions (changing price to 0)Modifying account verification statusAccess to premium features without payingModifying data that should not be user-editable
Examples
Mass Assignment for privilege escalation
The profile-update endpoint accepts any field from the body and passes it straight to the ORM. The attacker adds fields such as 'role' or 'verified' that don't appear in the form but that the model does accept.
# Legitimate profile-update request
PUT /api/users/me
Content-Type: application/json
{"name": "John", "email": "john@example.com"}
# Request with extra fields (Mass Assignment)
PUT /api/users/me
Content-Type: application/json
{"name": "John", "email": "john@example.com", "role": "admin", "verified": true}
# If the backend does: User.findByIdAndUpdate(userId, req.body)
# Without filtering req.body, the attacker becomes admin