Slide 15 of 28
Part 3 · Attack ScenariosSlide 15
Slide 15 · Scenario 2
A marketplace host changes the price of a guest's stay.
OWASP Scenario #2 — mass assignment lets a property manager overcharge guests.
📄 OWASP API Security Top 10 · 2023 · API3 · Scenario 2
SETUP
A rental platform's approval flow.

A short-term rental marketplace lets property hosts approve booking requests from guests. When a host approves a booking, their app sends a PUT request to confirm the stay.

The request body is supposed to contain: {"status": "approved"}. But the endpoint accepts and writes all fields it receives.

The exploit: A malicious host intercepts the approval request and adds "total_stay_price": "$10,000" to the body. The API accepts the extra field and writes it to the booking record. The guest's confirmed price is now $10,000 — whatever the host chose to set. The guest has no way to know this happened at the API level.
THE DAMAGE
The guest is charged the manipulated amount.

When checkout runs, it reads total_stay_price from the booking record — which now contains the host-modified value. The guest is charged an amount they never agreed to.

The marketplace may not catch this without monitoring for anomalous price values in the booking API, because the approval request itself looks structurally valid.

Why it works: The booking object has a total_stay_price field that hosts should never be able to set directly — prices are calculated by the platform. But the API accepted the field because nothing restricted what could be written.
← Back Scenario 3 →