Mass Assignment
Mass assignment is a framework automatically binding request parameters to object properties, letting attackers set unintended properties (e.g., isAdmin).
Purpose
To understand privilege escalation caused by automatic property binding and its defenses; a common vulnerability in Rails/Express.
Mechanism
The framework automatically binds JSON keys to model properties; an attacker appends isAdmin:true to the request to elevate privileges. Defenses: property whitelists (strong params), DTOs, explicit assignment.
Use cases
- Privilege escalation defense
- Property binding audit
- API security