Mass assignment is a
computer vulnerability where an
active record pattern In software engineering, the active record pattern is an architectural pattern. It is found in software that stores in-memory object data in relational databases. It was named by Martin Fowler in his 2003 book ''Patterns of Enterprise Application ...
in a
web application
A web application (or web app) is application software that is accessed using a web browser. Web applications are delivered on the World Wide Web to users with an active network connection.
History
In earlier computing models like client-serve ...
is abused to modify data items that the user should not normally be allowed to access such as password, granted permissions, or administrator status.
Many
web application framework
A web framework (WF) or web application framework (WAF) is a software framework that is designed to support the development of web applications including web services, web resources, and web APIs. Web frameworks provide a standard way to build and ...
s offer an
active record In software engineering, the active record pattern is an architectural pattern. It is found in software that stores in-memory object data in relational databases. It was named by Martin Fowler in his 2003 book ''Patterns of Enterprise Application ...
and
object-relational mapping features, where external data in
serialization
In computing, serialization (or serialisation) is the process of translating a data structure or object state into a format that can be stored (e.g. files in secondary storage devices, data buffers in primary storage devices) or transmitted (e ...
formats is automatically converted on input into internal
objects
Object may refer to:
General meanings
* Object (philosophy), a thing, being, or concept
** Object (abstract), an object which does not exist at any particular time or place
** Physical object, an identifiable collection of matter
* Goal, an ...
and, in turn, into database record fields. If the framework's interface for that conversion is too permissive and the application designer doesn't mark specific fields as immutable, it is possible to overwrite fields that were never intended to be modified from outside (e.g. admin permissions flag).
These vulnerabilities have been found in applications written in
Ruby on Rails
Ruby on Rails (simplified as Rails) is a server-side web application framework written in Ruby under the MIT License. Rails is a model–view–controller (MVC) framework, providing default structures for a database, a web service, and web p ...
,
ASP.NET MVC
ASP.NET MVC is a web application framework developed by Microsoft that implements the model–view–controller (MVC) pattern. It is no longer in active development. It is open-source software, apart from the ASP.NET Web Forms component, which is ...
, and
Java
Java (; id, Jawa, ; jv, ꦗꦮ; su, ) is one of the Greater Sunda Islands in Indonesia. It is bordered by the Indian Ocean to the south and the Java Sea to the north. With a population of 151.6 million people, Java is the world's List ...
Play framework
Play Framework is an open-source software, open-source web application framework which follows the model–view–controller (MVC) architectural pattern (computer science), architectural pattern. It is written in Scala (programming language), Sc ...
.
In 2012 mass assignment on Ruby on Rails allowed bypassing of mapping restrictions and resulted in
proof of concept
Proof of concept (POC or PoC), also known as proof of principle, is a realization of a certain method or idea in order to demonstrate its feasibility, or a demonstration in principle with the aim of verifying that some concept or theory has prac ...
injection of unauthorized
SSH
The Secure Shell Protocol (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Its most notable applications are remote login and command-line execution.
SSH applications are based on a ...
public keys into user accounts at
GitHub
GitHub, Inc. () is an Internet hosting service for software development and version control using Git. It provides the distributed version control of Git plus access control, bug tracking, software feature requests, task management, continuous ...
. Further vulnerabilities in Ruby on Rails allowed creation of internal objects through a specially crafted
JSON
JSON (JavaScript Object Notation, pronounced ; also ) is an open standard file format and data interchange format that uses human-readable text to store and transmit data objects consisting of attribute–value pairs and arrays (or other ser ...
structure.
In ASP.NET Core mapping restriction can be declared using the
indNever/code> attribute.
See also
* Data transfer object In the field of programming a data transfer object (DTOMSDN (2010). Data Transfer Object. Microsoft MSDN Library. Retrieved from https://msdn.microsoft.com/en-us/library/ms978717.aspx.Fowler, Martin (2010). Data Transfer Object. Patterns of Enterpri ...
(DTO)
References
{{Reflist
Web security exploits