Mass Assignment Cheat Sheet



{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |- Last revision (mm/dd/yy): //
 * valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

= Introduction =

Definition
"Modern frameworks allow developers to automatically bind HTTP request parameters from both request query and body into model objects for ease of development and increased productivity. If the binder is not correctly configured to control which HTTP request parameters are bound to which model attributes, an attacker may be able to abuse the model binding process and set any other attributes that should not be exposed to user control. This binding is possible even if the model attributes do not appear in the web forms or API contracts." - Mass Assignment: Sensitive Field Exposure

Alternative Names
Depending on the language/framework in question, this vulnerability can have several alternative names
 * Mass Assignment: Ruby on Rails, NodeJS
 * Autobinding: Spring MVC, ASP.NET MVC
 * Object injection: PHP

Example
Suppose there is a form for editing a user's account information:

  

Here is the object that the form is binding to:

public class User { private String userid; private String password; private String email; private boolean isAdmin; //Getters & Setters }

Here is the controller handling the request:

@RequestMapping(value = "/addUser, method = RequestMethod.POST)  public String submit(User user) {      userService.add(user);      return "successPage";   }

Here is the typical request:

POST /addUser userid=bobbytables&password=hashedpass&email=bobby@tables.com

And here is the exploit:

POST /addUser userid=bobbytables&password=hashedpass&email=bobby@tables.com&isAdmin=true

Exploitability
This functionality becomes exploitable when:
 * Attacker can guess common sensitive fields
 * Attacker has access to source code and can review the models for sensitive fields
 * The object with sensitive fields has an empty constructor

GitHub
In 2012, GitHub was hacked using mass assignment. A user was able to upload his public key to any organization and thus make any subsequent changes in their repositories. GitHub's Blog Post

Solutions

 * Whitelist the bindable, non-sensitive fields
 * Blacklist the non-bindable, sensitive fields
 * Use Data Transfer Objects (DTOs)

= General Solutions =

Data Transfer Objects (DTOs)
An architectural approach is to create Data Transfer Objects and avoid binding input directly to domain objects. Only the fields that are meant to be editable by the user are included in the DTO.

public class UserRegistrationFormDTO { private String userid; private String password; private String email; //private boolean isAdmin; //Getters & Setters }

= Language & Framework Specific Solutions =

Whitelisting
@Controller public class UserController {     @InitBinder public void initBinder(WebDataBinder binder, WebRequest request) {        binder.setAllowedFields(["userid","password","email"]); }     ...   }

Reference

Blacklisting
@Controller public class UserController {     @InitBinder public void initBinder(WebDataBinder binder, WebRequest request) {        binder.setDisallowedFields(["isAdmin"]); }     ...   } Reference

NodeJS + Mongoose
Reference

Ruby On Rails
Reference

Django
Reference

ASP.NET
Reference

Whitelisting
<?php namespace App; use Illuminate\Database\Eloquent\Model; class User extends Model {     private $userid; private $password; private $email; private $isAdmin; protected $fillable = array('userid','password','email'); }

Reference

Blacklisting
<?php namespace App; use Illuminate\Database\Eloquent\Model; class User extends Model {     private $userid; private $password; private $email; private $isAdmin; protected $guarded = array('isAdmin'); }

Reference

Grails
Reference

Play
Reference

Jackson (JSON Object Mapper)
Reference Reference

GSON (JSON Object Mapper)
Reference Reference

JSON-Lib (JSON Object Mapper)
Reference

Flexjson (JSON Object Mapper)
Reference

= Authors and Primary Editors =
 * [mailto:abashkin.anton@gmail.com Abashkin Anton]

= References and future reading =
 * Mass Assignment, Rails and You http://code.tutsplus.com/tutorials/mass-assignment-rails-and-you--net-31695

= Other Cheatsheets =


 * }