API3:2023 — Broken Object Property Level Authorization

Slide 5 · Why It Keeps Happening

Developer convenience is the root cause.

Two framework defaults that trade security for speed.

On the write side: "Bind Everything"

ORM frameworks — Ruby on Rails, Django, Laravel, Spring — have a feature that maps incoming HTTP parameters directly to model properties. It's designed to save boilerplate: instead of manually mapping each field, the framework does it automatically.

The danger: it binds all fields by default, including ones that were never meant to be user-editable. Developers add isAdmin to the database schema and forget to protect it from mass assignment. The framework happily accepts it from any POST request.

# Rails: the vulnerable pattern that hit GitHub def update @key.update_attributes(params[:public_key]) # binds ALL params end # Attacker sends: POST /public_keys public_key[key]=ssh-rsa+AAAA...&public_key[user_id]=4223

On the read side: "Return Everything"

When developers build API endpoints, the easiest implementation is to serialize the entire database object and return it. The frontend is then responsible for filtering what to display.

The danger: the API is not the same as the frontend. Any developer, security researcher, or attacker can call the API directly and receive the full unsanitized object — including fields the UI would have hidden.

← Back What's the actual damage? →