Slide 12 of 28
Part 2 · How It WorksSlide 12
Slide 12 · Mass Assignment
The framework binds everything. The developer forgot to stop it.
One extra JSON field. The server writes it. You just escalated your privileges.
How it happens

Modern web frameworks have a convenience feature: they automatically map incoming request parameters to model fields. You don't write code to copy each field — the framework does it for you.

This is called mass assignment or auto-binding. When a developer uses it without restricting which fields are allowed, every property in the model becomes potentially settable by the user.

# Legitimate request to update a user profile PUT /api/users/1042 { "name": "Jane Smith", "bio": "Software engineer" } # Attacker adds extra fields the server never expected users to send PUT /api/users/1042 { "name": "Jane Smith", "bio": "Software engineer", "isAdmin": true, "role": "admin", "verified": true, "balance": 9999.00 } # Without an allowlist, the server writes ALL of these to the database
Why no error is returned

The server doesn't know the attacker "shouldn't" be setting these fields — it just sees valid JSON with valid field names that exist in the model. No validation error. No warning. The response looks identical to a legitimate update. The attacker has to check the effect themselves.

← Back Real incident: GitHub 2012 →