Mass Assignment Vulnerabilities
One Extra Parameter. Admin Access Granted.

// Your User model (Node.js/Express example)
const userSchema = {
  username: String,
  email: String,
  password: String,
  role: { type: String, default: 'user' },  // <-- The target
  isAdmin: { type: Boolean, default: false } // <-- Also a target
};

// Your vulnerable update endpoint
app.put('/api/users/me', authenticate, async (req, res) => {
  const user = await User.findById(req.user.id);
  
  // This single line is the vulnerability
  Object.assign(user, req.body);
  
  await user.save();
  res.json(user);
});

// Normal request - what you expect:
PUT /api/users/me
{ "email": "newemail@example.com" }

// Attack request - what actually happens:
PUT /api/users/me
{ 
  "email": "attacker@example.com",
  "role": "admin",
  "isAdmin": true
}

// Result: Attacker is now an admin. No errors thrown.

# GitHub's vulnerable endpoint accepted public key updates
# The form allowed updating SSH keys for the authenticated user

# Normal request structure:
POST /users/rails/keys
public_key[title]=my_key
public_key[key]=ssh-rsa AAAA...

# Homakov's attack request:
POST /users/rails/keys  
public_key[title]=my_key
public_key[key]=ssh-rsa AAAA...
public_key[user_id]=4223  # <-- Rails core team member's ID

# Rails' mass assignment automatically bound user_id
# The SSH key was added to the wrong account
# Homakov gained push access to the Rails repository

# The fix? Explicitly define which attributes are assignable:
# Ruby on Rails introduced strong_parameters:
params.require(:public_key).permit(:title, :key)
# Now user_id cannot be passed through the form

// Your API accepts nested updates
PUT /api/users/me
{
  "profile": {
    "displayName": "John Doe",
    "bio": "Developer"
  }
}

// Your backend processes this with deep merge:
const updateUser = async (userId, data) => {
  const user = await User.findById(userId);
  
  // Deep merge - recursively copies nested properties
  _.merge(user, data);
  
  await user.save();
};

// Attack: Inject properties through nested paths
PUT /api/users/me
{
  "profile": {
    "displayName": "Attacker",
    "__proto__": { "isAdmin": true }  // Prototype pollution
  },
  "permissions": {
    "canDeleteUsers": true,
    "canAccessBilling": true
  },
  "subscription": {
    "tier": "enterprise",
    "expiresAt": "2099-12-31"
  }
}

// Defense: Use schema validation + explicit field allowlisting
const allowedFields = ['profile.displayName', 'profile.bio'];
const sanitized = pick(data, allowedFields);

// E-commerce cart update endpoint
PUT /api/cart
{
  "items": [
    { "productId": "prod_123", "quantity": 2 }
  ]
}

// Vulnerable implementation
app.put('/api/cart', async (req, res) => {
  const cart = await Cart.findByUserId(req.user.id);
  cart.items = req.body.items;  // Direct assignment
  await cart.save();
});

// Attack: Inject price overrides or unauthorized discounts
PUT /api/cart
{
  "items": [
    { 
      "productId": "prod_123", 
      "quantity": 2,
      "priceOverride": 0.01,     // <-- Injected field
      "discountPercent": 99      // <-- Injected field
    }
  ],
  "appliedCoupons": ["ADMIN_INTERNAL_100_OFF"]  // <-- Injected array
}

// If your order processing trusts these fields...
// Attacker just bought your products for $0.01

// Defense: Validate and transform, never directly assign
const sanitizedItems = req.body.items.map(item => ({
  productId: item.productId,
  quantity: parseInt(item.quantity, 10)
  // Only explicitly copied fields are included
}));