Examkin

Question

Difficulty: HardApplication and Software Vulnerabilities

During an application security audit of a cloud-native microservices platform, an analyst inspects API logs for a customer profile service. The service accepts HTTP POST updates in JSON format. The analyst discovers that an attacker sent a modified JSON request payload containing an unadvertised field: `"is_admin": true`. The backend REST framework automatically instantiated the incoming JSON parameters directly into the internal user account object, successfully elevating the standard user's privileges without triggering any schema errors. Which software vulnerability is demonstrated in this scenario, and what primary remediation should developers implement?

  1. Mass assignment vulnerability; remediated by implementing explicit Data Transfer Objects (DTOs) and allow-listing permitted binding properties.Answer
  2. B
    Broken authentication vulnerability; remediated by requiring multi-factor authentication (MFA) step-up tokens prior to submitting JSON update requests.
  3. C
    Cross-Site Scripting (XSS) vulnerability; remediated by applying contextual output encoding on dynamic response attributes.
  4. D
    Mass assignment vulnerability; remediated by deploying a network Layer 4 stateful firewall to block incoming HTTP POST requests containing privilege keywords.

Answer

The correct answer identifies the flaw as a mass assignment vulnerability and specifies remediation using explicit Data Transfer Objects (DTOs) or parameter allow-listing.
Mass assignment (also known as over-posting or auto-binding) occurs when web application frameworks automatically bind client-provided HTTP request parameters directly to internal data model fields without input filtering. If sensitive attributes like user roles or account balances exist on the model, an attacker can append those fields to the request payload and overwrite them. The effective remediation is to enforce input separation through Data Transfer Objects (DTOs) or parameter allow-listing so only authorized fields are bound.

Step-by-Step Solution

1
Analyze the attack payload and backend framework behavior in the scenario.
The client supplied an unexpected JSON parameter (`"is_admin": true`), which the backend framework automatically bound to internal object properties.
Automatic binding of request parameters directly to domain models without property filtering constitutes a mass assignment (or over-posting) vulnerability.
2
Evaluate the underlying root cause.
The application lacks a validation layer or object boundary separating raw HTTP inputs from internal domain objects.
Without strict parameter filtering, attackers can set sensitive internal fields that were never meant to be modified by client requests.
3
Select the appropriate software-level mitigation.
Implement Data Transfer Objects (DTOs) or field allow-lists in the application controller.
DTOs explicitly define which properties are permitted to be bound from incoming requests, preventing unauthorized object attribute modification.

Key Concept

Mass Assignment Vulnerability and Parameter Binding Protection
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic