Mass assignment vulnerability: Difference between revisions

Revision as of 16:04, 27 February 2013

Revision as of 16:05, 27 February 2013

Line 1:

'''Mass assignment''' is a [[vulnerability (computing)|computer vulnerability]] where an [[active record pattern]] in [[web application]] is abused to modify data items that the user should be not normally allowed to access — for example password, granted permissions or administrator status.

Many [[web application framework]]s offer an [[active record pattern|active record]] feature, where a database record fields can be modified by an automatically generated web API methods. If the framework doesn't prevent that automatically and the application designed doesn't mark specific fields as immutable this way, it's possible to abuse the API call and modify these hidden fields<ref>{{cite web | url=http://cwe.mitre.org/data/definitions/915.html | title=CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes | publisher=NIST | work=Common Weakness Enumeration | accessdate=February 27, 2013}}</ref>.