Skip to content

Web Mass Assignment Vulnerabilities

Several frameworks offer handy mass-assignment features to lessen the workload for developers.

Ruby on Rails

Ruby on Rails is a web application framework that is vulnerable to this type of attack. The following example shows how attackers can exploit mass assignment vulnerability in Ruby on Rails. Assuming we have aĀ UserĀ model with the following attributes:

1
2
3
class User < ActiveRecord::Base
  attr_accessible :username, :email
end

By tampering with the parameters sent to the server we could send the following parameters:

1
{ "user" => { "username" => "hacker", "email" => "hacker@example.com", "admin" => true } }

Although theĀ UserĀ model does not explicitly state that theĀ adminĀ attribute is accessible, the attacker can still change it because it is present in the arguments. Bypassing any access controls that may be in place, the attacker can send this data as part of a POST request to the server to establish a user with admin privileges.

Another example

Suppose we come across the following application that features an Asset Manager web application. Also suppose that the application's source code has been provided to us. Completing the registration step, we get the messageĀ Success!!, and we can try to log in.

After login in, we get the messageĀ Account is pending approval. The administrator of this web app must approve our registration. Reviewing the python code of theĀ /opt/asset-manager/app.pyĀ file reveals the following snippet.

1
2
3
4
5
6
for i,j,k in cur.execute('select * from users where username=? and password=?',(username,password)):
  if k:
    session['user']=i
    return redirect("/home",code=302)
  else:
    return render_template('login.html',value='Account is pending for approval')

We can see that the application is checking if the valueĀ kĀ is set. If yes, then it allows the user to log in. In the code below, we can also see that if we set theĀ confirmedĀ parameter during registration, then it insertsĀ condĀ asĀ TrueĀ and allows us to bypass the registration checking step.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
try:
  if request.form['confirmed']:
    cond=True
except:
      cond=False
with sqlite3.connect("database.db") as con:
  cur = con.cursor()
  cur.execute('select * from users where username=?',(username,))
  if cur.fetchone():
    return render_template('index.html',value='User exists!!')
  else:
    cur.execute('insert into users values(?,?,?)',(username,password,cond))
    con.commit()
    return render_template('index.html',value='Success!!')

In that case, what we should try is to register another user and try setting theĀ confirmedĀ parameter to a random value. Using Burp Suite, we can capture the HTTP POST request to theĀ /registerĀ page and set the parametersĀ username=new&password=test&confirmed=test.

We can now try to log in to the application using theĀ new:testĀ credentials.

The mass assignment vulnerability is exploited successfully and we are now logged into the web app without waiting for the administrator to approve our registration request.

Last update: 2025-06-01
Created: June 1, 2025 11:12:15