Security Test: Mass Assignment¶

Description¶

Default Severity: high

Mass assignment happens when an application automatically assigns user-supplied data to an object without properly filtering out unwanted fields. This can be dangerous because an attacker might include extra properties in a request that, if accepted, could grant them unauthorized access or let them modify sensitive configurations. The common mistake is not explicitly limiting which fields the application accepts from user input, which leaves room for manipulation and potential privilege escalation if an attacker can control critical properties.

Configuration¶

Identifier: injection/mass_assignment

Examples¶

All configuration available:

checks:
  injection/mass_assignment:
    skip: false # default

Compliance and Standards¶