sc-mass-assignment

Mass assignment vulnerability occurs when user input binds directly to data models without filtering, allowing attackers to overwrite sensitive fields like isAdmin or role. It exposes endpoints to privilege escalation and data tampering risks across web frameworks.

Prevent mass assignment by applying explicit field whitelisting, using Data Transfer Objects (DTOs), or enabling framework-level protections. Analyzing endpoint bindings ensures only explicitly allowed properties map to your data models.

Yes, it analyzes endpoints across Node.js/Express, Django, Laravel, Spring Boot, and ASP.NET. It identifies unsafe model bindings within these specific web frameworks and provides tailored remediation guidance for each.

Find unsafe model bindings by scanning endpoints that map request payloads directly to data models. The analysis identifies unfiltered bindings and generates actionable recommendations for implementing safe field whitelisting or DTOs.

The best way to secure request binding is enforcing explicit field whitelists or using DTOs to filter user input before it reaches the model. Framework-level protections can also automatically block unapproved properties from being bound.