← All categories

Mass Assignment

Unsafe Model Binding

0 / 4 solved

Modify fields the frontend never intended users to control and see whether the backend binds them anyway.

Quick reference

Mass assignment cheat sheet

Capture a legitimate object update, then test whether the server accepts properties that the normal UI never lets the user change.

Where to look

  • Profile update APIs, account settings, user/admin models, billing/workspace settings, registration endpoints, and JSON PATCH/PUT requests.
  • Compare properties returned by GET responses with the smaller set submitted by the frontend.
  • Look for server-controlled fields such as role, isAdmin, verified, balance, credit, plan, ownerId, status, permissions, or tenantId.

Simple checks

  • Keep the valid request intact and add exactly one unexpected property.
  • Observe whether the server ignores it, rejects it, or persists it.
  • Repeat with a second account/object when ownership-related fields are involved.
{"displayName":"Maya","role":"admin"}company=Acme&phone=5550100&storeCredit=5000

Realistic tips

  • Do not blindly add hundreds of fields. Infer likely model properties from responses, client code, API docs, and naming conventions.
  • The secure pattern is an explicit allowlist/request DTO plus authorization for sensitive state transitions.
  • Mass assignment can create privilege escalation, business-logic abuse, or cross-tenant ownership changes depending on the field.