🧪 Labs › Business Logic
Mass Assignment
Severity: High
Send fields the form never showed you, and the server saves them anyway.
What it is
Mass assignment happens when an endpoint binds the whole request body straight onto an object. You submit a profile update with name and bio — but if you also include role=admin or isVerified=true, and the server binds blindly, those get saved too.
The vulnerable fields are the ones the UI doesn't expose but the data model contains.
It turns a benign update into privilege escalation or state tampering.
How to approach it
- Find an endpoint that accepts an object and persists it (sign-up, profile update, settings).
- Learn the object's real shape — from a GET response, the API schema, or guessing conventional names (role, admin, verified, balance, id).
- Add those fields to your request and check whether the server honours them.
- Confirm the change took effect, not just that the request was accepted.
Your task
Set a property on your account that the interface never offers — and have the server keep it.
▶ Access the labOpens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.
How to prevent it
- Bind only an explicit allowlist of fields; never the raw request body.
- Use separate input models from your persistence models.
- Treat every settable field as attacker-controlled.
More Business Logic labs
- Race Conditions — Fire the same action many times at once and slip through the gap before the check catches up.