mass-assignment-audit

Detect mass assignment vulnerabilities by auditing request body binding patterns in API controllers. The scan identifies dangerous ORM update methods, such as blindly passing user request data to models without explicit allowlists.

A mass assignment vulnerability occurs when applications blindly bind user-provided request data to database models. This allows attackers to escalate privileges or modify restricted fields like role or is_admin via PATCH or PUT requests.

Prevent unauthorized attribute modification by implementing strong parameters, fillable or guarded model configurations, and manual field assignment. Validate that ORM update methods include explicit field allowlists for data handling.

Yes, this mass assignment audit supports Java and PHP frameworks. It targets insecure data handling across JavaScript, Python, Ruby, Java, and PHP frameworks by validating field-level access controls and allowlists.

The best way to scan a codebase is to identify all instances of ORM update methods lacking explicit field allowlists. This validates the presence of strong parameters and access controls to prevent unauthorized attribute modification.

Audit API controllers for mass assignment security issues during a security review. This ensures sensitive fields like role, is_admin, or price cannot be manipulated by unauthorized users through request body binding.