Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

During a security assessment of a microservices-based web application, an analyst reviews API traffic logs for the user settings service. The logs show that an authenticated user transmitted an HTTP PATCH request to update their profile information. By adding the property "is_admin": true to the JSON request payload, the user successfully elevated their permissions on the platform because the backend automatically bound the request fields directly to the internal data model. Which of the following best identifies the root cause vulnerability and the most effective developer remediation?

  1. Mass assignment; restrict object parameter binding by using data transfer objects (DTOs) or field allowlists on the backend.Answer
  2. B
    Cross-site scripting (XSS); sanitize all incoming database queries using parameterized SQL statements.
  3. C
    Broken authentication; enforce multi-factor authentication (MFA) across all web application user login endpoints.
  4. D
    Insecure direct object reference (IDOR); configure external perimeter firewall rules to drop all HTTP PATCH requests containing JSON bodies.

Answer

Mass assignment; restrict object parameter binding by using data transfer objects (DTOs) or field allowlists on the backend.
The correct answer identifies mass assignment as the root cause vulnerability and parameter allowlisting as the effective mitigation. Mass assignment (also known as auto-binding) occurs when software frameworks automatically bind incoming HTTP payload parameters to internal data structures without restricting allowable fields. Attackers exploit this by injecting unexpected properties like privilege flags. Creating explicit Data Transfer Objects (DTOs) or field allowlists restricts parameter binding exclusively to authorized attributes.

Step-by-Step Solution

1
Analyze the log entries and application behavior
The application automatically maps unvalidated request payload parameters directly to internal data models, enabling unauthorized field modification.
This auto-binding behavior allows users to manipulate parameters that should only be controlled by the server, indicating a mass assignment vulnerability.
2
Distinguish between identity verification and object attribute authorization
The threat relies on missing server-side schema boundaries rather than unauthenticated user access.
Authenticating users does not block an authenticated user from including unexpected JSON properties in an API call.
3
Identify the appropriate software remediation strategy
Enforce strict schema limits using Data Transfer Objects (DTOs) or field allowlisting on the backend.
Restricting parameter binding at the code level prevents hidden or privileged object attributes from being modified by client inputs.

Key Concept

Mass Assignment Vulnerability and Parameter Binding Defense
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic