mass-assignment

A mass assignment vulnerability occurs when an attacker adds unexpected fields to request payloads to manipulate ORM objects or domain models, causing unauthorized updates to sensitive model attributes that should not be user-controllable.

Prevent mass assignment by implementing explicit input filtering using DTOs or typed models, ensuring only whitelisted fields are accepted by the application input layer before deserializing user input into ORM objects.

Yes, this protection applies to backend services and API endpoints across languages like Django, Spring, Rails, and Node, requiring explicit input filtering and server-side assignment for privileged fields.

The best way to restrict user-controllable fields is implementing a dedicated input type or DTO that validates input and restricts fields before database writes, providing a safe default by setting privileged fields server-side.

Field whitelisting is needed because attackers can manipulate request payloads by including fields that should not be user-controllable, allowing them to bypass permissions and directly update sensitive model attributes.