Wikipedia

Mass assignment vulnerability

This is an old revision of this page, as edited by BG19bot (talk | contribs) at 22:37, 8 March 2013 (WP:CHECKWIKI error fix for #61. Punctuation goes before References. Do general fixes if a problem exists. - using AWB). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Mass assignment is a computer vulnerability where an active record pattern in web application is abused to modify data items that the user should be not normally allowed to access — for example password, granted permissions or administrator status.

Many web application frameworks offer an active record feature, where a database record fields can be modified by an automatically generated web API methods. If the framework doesn't prevent that automatically and the application designed doesn't mark specific fields as immutable this way, it's possible to abuse the API call and modify these hidden fields.[1]

These vulnerabilities were found in applications written in Ruby on Rails,[2] ASP.NET MVC Framework,[3] PHP and Python.

In 2012 mass assignment on Ruby on Rails was published that allowed injection of unauthorized SSH public keys into user accounts at GitHub.[4]

  1. ^ "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes". Common Weakness Enumeration. NIST. Retrieved February 27, 2013.
  2. ^ "Mass Assignment". Ruby On Rails Security Guide. Retrieved February 27, 2013.
  3. ^ "Mass Assignment Vulnerability in ASP.NET MVC". IronsHay. Retrieved February 27, 2013.
  4. ^ "GitHub suspends member over 'mass-assignment' hack". ZDnet. 2012. Retrieved February 27, 2013.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Mass_assignment_vulnerability&oldid=542917049"