Mass Assignment

Question 1

What is a mass assignment vulnerability?

Answer 1

It’s a vulnerability where an attacker can overwrite object properties by adding parameters to a request.

Question 2

What are the factors that allow a mass assignment attack?

Answer 2

Three things must be in place:
1. The request must accept user input
2. The request must be able to alter values not available to the user (Potential to modify objects).
3. Missing security controls to handle user input.

Question 3

Can you use an API documentation to try to find mass assignment vulnerabilities? Explain.

Answer 3

Yes. It’s recommended to search for requests that are possibly vulnerable to mass assignment in the documentation or collection. Also, it’s very important to understand the parameters used in the requests and try to add them in other interesting ones.

Question 4

Which of the following is required for a mass assignment vulnerability to be present?
a) An API must not have rate limiting in place
b) An API must not have a web application firewall
c) An API must be lacking user input validation
d) An API must be using JSON Web Tokens

Answer 4

Letter c.