Mass assignment vulnerability: Difference between revisions

Revision as of 03:41, 10 August 2012

Latest revision as of 12:10, 18 December 2024

(37 intermediate revisions by 21 users not shown)

Line 1:

{{Short description|Computer vulnerability}}

This can be used to submit extra data to a [[Form (web)|Web form]], thus bypassing additional access, etc.

'''Mass assignment''' is a [[vulnerability (computing)|computer vulnerability]] where an [[active record pattern]] in a [[web application]] is abused to modify data items that the user should not normally be allowed to access such as password, granted permissions, or administrator status.

Many [[web application framework]]s offer an [[active record pattern|active record]] and [[object-relational mapping]] features, where external data in [[serialization]] formats is automatically converted on input into internal [[Object (computer science)|objects]] and, in turn, into database record fields. If the framework's interface for that conversion is too permissive and the application designer doesn't mark specific fields as immutable, it is possible to overwrite fields that were never intended to be modified from outside (e.g. admin permissions flag).<ref>{{cite web | url=http://cwe.mitre.org/data/definitions/915.html | title=CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes | publisher=NIST | work=Common Weakness Enumeration | accessdate=February 27, 2013}}</ref>

== References ==

*[http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7310 CVE-2008-7310]

*[http://blog.mhartl.com/2008/09/21/mass-assignment-in-rails-applications/ Mass assignment in Rails applications]

*[http://arstechnica.com/business/2012/03/hacker-commandeers-github-to-prove-vuln-in-ruby/ Hacker commandeers GitHub to prove Rails vulnerability]

*[http://www.zdnet.com/github-suspends-member-over-mass-assignment-hack-4010025556/ GitHub suspends member over 'mass-assignment' hack]

*[https://github.com/rails/rails/issues/5228 Rails bug report]

*[http://guides.rubyonrails.org/security.html#mass-assignment Mass Assignment section in the Ruby On Rails Security Guide]

*[https://groups.google.com/d/topic/cake-php/FcVBqxifvck/discussion "Mass Assignment Vulnerability" - protection in Cake] -- requires login to Google

*[http://stackoverflow.com/questions/10458468/does-cakephp-automatically-deal-with-mass-assignment-vulnerabilities-when-saving Does CakePHP automatically deal with mass assignment vulnerabilities when saving modified data?]

*[http://ironshay.com/post/Mass-Assignment-Vulnerability-in-ASPNET-MVC.aspx Mass Assignment Vulnerability in ASP.NET MVC]

These vulnerabilities have been found in applications written in [[Ruby on Rails]],<ref>{{cite web | url=http://guides.rubyonrails.org/security.html#mass-assignment | title=Mass Assignment | work=Ruby On Rails Security Guide | accessdate=February 27, 2013}}</ref> [[ASP.NET MVC]],<ref>{{cite web | url=http://ironshay.com/post/Mass-Assignment-Vulnerability-in-ASPNET-MVC.aspx | title=Mass Assignment Vulnerability in ASP.NET MVC | publisher=IronsHay | accessdate=February 27, 2013}}</ref> and [[Java (software platform)|Java]] [[Play framework]].<ref>{{cite web|url=http://alots.wordpress.com/2014/03/26/playframework-how-to-protect-against-mass-assignment/ |title=Playframework, how to protect against Mass Assignment |date=2014 |author=Alberto Souza}}</ref>

{{Compu-prog-stub}}

In 2012 mass assignment on Ruby on Rails allowed bypassing of mapping restrictions and resulted in [[proof of concept]] injection of unauthorized [[Secure Shell|SSH]] public keys into user accounts at [[GitHub]].<ref>{{cite web | url=https://www.zdnet.com/home-and-office/networking/github-suspends-member-over-mass-assignment-hack/ | title=GitHub suspends member over 'mass-assignment' hack | publisher=ZDnet | year=2012 | access-date=February 27, 2013}}</ref><ref>{{cite web | url=http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/ | title=[SEC][ANN] Rails 3.2.12, 3.1.11, and 2.3.17 have been released! | accessdate=January 7, 2016}}</ref> Further vulnerabilities in Ruby on Rails allowed creation of internal objects through a specially crafted [[JSON]] structure.<ref>{{cite web | url=https://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/ | title=Denial of Service and Unsafe Object Creation Vulnerability in JSON (CVE-2013-0269) | accessdate=January 7, 2016}}</ref>

In ASP.NET Core mapping restriction can be declared using the <code>[BindNever]</code> attribute.<ref>{{cite web|url=https://docs.microsoft.com/en-us/aspnet/core/mvc/models/model-binding|title=Model Binding in ASP.NET Core|last=tdykstra|website=docs.microsoft.com|date=20 June 2023 }}</ref>

== See also ==

* [[Data transfer object]] (DTO)

== References ==

{{Reflist}}

[[Category:Web security exploits]]