Skip to content
REDMAW

Applications

Mass Assignment

An API trusts fields the client was never meant to control, letting an attacker modify hidden properties such as roles, ownership or account state.

RedMaw

Definition

Mass assignment happens when an application binds incoming request fields directly onto an internal object without restricting which fields a client may set. Convenient to write, and it quietly delegates authorization to the request body.

Why it is easy to miss

Nothing looks broken. The documented fields behave correctly, tests pass, and the endpoint returns the expected shape. The weakness only appears when a request includes a field the documentation never mentioned: a role, an owner reference, a verification flag, an internal status.

Fields worth probing

  • Role, permission or group membership
  • Ownership or tenant references
  • Verification, approval and activation flags
  • Internal pricing, quota or entitlement state
  • Identifiers the server should assign rather than accept
Where it leads
  1. User
  2. API Request
  3. Hidden Property
  4. Privileged State
  5. Unauthorized Access

Each hop validated by successful exploitation

Tags

  • api
  • authorization
  • privilege escalation

Validation

How RedMaw validates this attack

Validation runs only inside authorized scope, with agreed exploitation limits.

  1. 01Enumerate fields the object model exposes beyond the documented contract
  2. 02Submit properties the client should not control
  3. 03Establish whether privileged state actually changed
  4. 04Preserve the request and the resulting state as evidence

Keep going

Related

Capabilities

Use cases

Stop assuming you are secure. Prove it.

Continuously test what an attacker can actually reach across your applications, SaaS identities, internal infrastructure and AI systems.

Request a demoExplore the platform