🧨

API6:2019 Mass Assignment

introduction

API6:2019 Excessive Data Exposure

Threat agents/attack vectorsSecurity weaknessImpacts
To thouroughly understand this issue we need to have great overview of the logic that is used and the objects so notes are very important here. If you see any object, note it down. The same goes for makes notes about the applications' logic. Pay close attention to the properties of the object when noting them down.Applications these days try to focus heavily on using frameworks which will automatically link the front end objects into variables. While this does cut down on development time, attackers can often use these frameworks to their advantage by updating bound variables they should not be able to edit such as "isAdmin: false > isAdmin:true" The impact really depends on what property of what object you were able to edit. For example if i can make myself admin by changing the isAdmin property of my own user object would be worse than if i could edit the stock of a product, even though that is also bad. As you can see, this vulnerability has a big range when it comes to impact.

What is Mass Assignment?

Applications these days often rely an objects (For example user, product, ...) and these objects have properties (for example product.stock). As a user, we have the authorization to edit and view specific properties of the objects but we might also be limited and not able to edit or view some specific properties (For example user can view product.stock but user should not be able to edit product.stock). These properties are then matched to parameters on the front-end and if these conversion happen automatically, they might convert parameters to properties the attacker should not be able to access (For example, the user should never be able to edit product.title but the front-end might convert a paramter "title" to product.title if the user sends a PUT request).

Here are some more examples of properties the user should not be able to edit:

Example Attack Scenarios

These attack scenario's come from my personal experience as a bug bounty hunter. This happens to be my favourite issue types because it's really to miss them and you can not automate the search easily due to the required logic knowledge.

The first example is from an application that allows you to make an appointment which last 1 hour. In the UI I am able to see timeslots that last 1 hour and i can select one of them.

I was staring at the request and did not notice it at first, it took me a good hour to realise it:

{
"startDate":"29/04/2022 11:00",
"endDate":"29/04/2022 12:00",
"userID":"123",
"consultantID":"123"
}

If we change the start or end date we can fully book the agenda of the consultant for years if we wish. This is very easy to miss which is why i like this issue type so much!

{
"startDate":"29/04/2022 11:00",
"endDate":"29/04/2099 12:00",
"userID":"123",
"consultantID":"123"
}

A second example is that i love to look at my account settings when i am hacking to see if i can't find any properties in the api responses that I should not be able to edit to make myself admin for example but this is about a much more subtle bug.

Request:
{
"endDate":"29/04/2099 12:00",
"userID":"123",
"consultantID":"123"
}

Response from API:

{
"AccountType":"airport",
"endDate":"29/04/2099 12:00",
"userID":"123",
"consultantID":"123"
}

There are two account types in here, these account types can not be found in the requests themselves but only in the respones however if i copy over that parameter, i might be able to change it as the API might automatically map the object.

Request:
{
"endDate":"29/04/2099 12:00",
"userID":"123",
"consultantID":"123"
"AccountType":"airline",
}

Response from API:

{
"AccountType":"airline",
"endDate":"29/04/2099 12:00",
"userID":"123",
"consultantID":"123"
}

A second subtilty that comes into play is that we need know that it's a pretty bad thing to change account types but looking at the website (which was not in scope but it's a public asset, www.FAKEPAGE.com ) on that page we found that one account type costs a lot more than the other thus increasing the impact.

Preventive measures against Mass Assignment

Conclusion

As you can see you need to think very carefully about the function of every parameter and make sure you understand what it means and what all the options are with that specific property. Make sure you investigate all the properties the objects have on the API and that unused properties do not get sent to production where they might get abused.