| name | api-mass-assignment |
| description | Mass assignment / auto-binding privilege escalation. Load when an API binds JSON directly to a model (Rails, Spring, Django REST, Node/Mongoose), on signup/profile-update/create endpoints, or when responses expose fields you didn't send (role, isAdmin, balance, verified). Signals: ORM object binding, extra fields accepted silently.
|
| domain | api |
| type | technique |
| stability | learning |
| modes | ["pentest","bugbounty"] |
| severity | high |
| owasp_api | ["API3:2023-BOPLA"] |
| cwe | ["CWE-915"] |
| tools | ["burp","postman"] |
| schema_version | 1 |
Mass assignment (BOPLA)
When it applies
An endpoint deserializes client JSON straight into a data object without an allowlist of
writable fields. You add sensitive properties the developer never meant to be client-writable.
Why it works
Frameworks that auto-bind request bodies to models will set any matching attribute unless
explicitly restricted. If role, isAdmin, account_balance, email_verified, or
user_id are bindable, you set them by just including them in the body.
Method
- Learn the object shape: read a GET response for the object — every returned field is a
candidate writable property. Also mine JS, mobile apps, and API docs for hidden fields.
- Inject sensitive fields into create/update requests:
{"username":"x","password":"y","role":"admin"} or "isAdmin":true, "verified":true,
"balance":999999, "user_id":<victim>.
- Guess conventions when fields aren't leaked:
is_admin, admin, roleId, groups,
permissions, account_type, tenant_id — try nested objects too ({"role":{"id":1}}).
- Chain: set
user_id/owner_id to a victim to combine with IDOR, or flip verified
to skip email/2FA gates.
Gotchas
- Extra fields silently ignored ≠ safe — confirm by reading the object back for your change.
- Some frameworks need the exact case/nesting; mirror the GET response structure.
- The writable field may only take effect on a specific endpoint/verb (create vs update).
Verify success
A privileged attribute you supplied is persisted — re-fetch the object and see role:admin,
verified:true, or the elevated value reflected, and confirm the new capability works.
References
OWASP API Security Top 10 (2023) API3; framework strong-params/allowlist docs.
