Issue Details
Mass Assignment
api06-2019 • Rank #6 in OWASP 2023
Explanation
Mass assignment happens when APIs automatically bind request body fields to domain models without strict field-level controls. Attackers inject hidden or sensitive properties such as role flags, account status, price fields, or ownership attributes. This bypasses intended workflows and can lead to privilege escalation or business logic corruption.
Remedy
Use explicit allowlists for writable fields in each endpoint and block unknown input properties. Separate external input models from internal persistence models. Add validation for immutable fields and privileged attributes, and include tests that attempt to override restricted properties during create and update operations.
| Year | Rank | Category |
|---|---|---|
| 2019 | #6 | api06-2019 - Mass Assignment |