What is Mass Assignment?

Mass assignment occurs when a framework automatically maps many request fields to a model without excluding security-sensitive properties. An attacker adds hidden parameters such as is_admin, account_id, price or status and may alter authorization or business logic.

Vulnerable Laravel example

// Attacker request
{
  "name": "Alice",
  "email": "alice@example.test",
  "is_admin": true
}

// Vulnerable: all input fields are mapped
$user = User::create($request->all());

Safer: validate and deliberately map permitted input.

$data = $request->validate([
    'name' => ['required', 'string', 'max:100'],
    'email' => ['required', 'email'],
]);

$user = User::create($data);

// Additional model boundary
protected $fillable = ['name', 'email'];

A model allowlist helps but is not always enough: a field assignable in one administrative use case may be forbidden for another role. Separate DTOs, commands, policies and explicit assignment are stronger for sensitive properties.

Where does it occur?

• Registration:
  Role, verification or tenant ID comes from the body.
• Orders:
  Price, discount, owner or payment status is writable.
• APIs:
  A generic PATCH endpoint recursively binds JSON to database objects.
• GraphQL:
  Large input objects are passed directly to ORM models.

Prevention

• - Define a positive list of fields and types per use case.
• - Authorize at object and field level, not only on the route.
• - Separate transport DTOs from database models.
• - Derive role, price and ownership server-side from trusted context.
• - Add negative tests that deliberately submit unknown and nested fields.

Testing and open-source tools

Compare visible inputs with API schemas, responses and object models, then submit harmless candidate fields against owned test data and verify persisted state as different roles. OWASP ZAP and ffuf can vary JSON or form parameters. Semgrep finds framework-specific patterns such as create(request.all). Every result requires manual authorization and state validation.