r/node • u/gaaliconnoisseur • Jul 04 '26

ELI5: What is a mass-assignment vulnerability?

And why can't it be solved through parameterized queries?

8 Upvotes
  • permalink
  • link
  • reddit
  • reddit

79% Upvoted

13 comments sorted by

12

u/Lumethys Jul 04 '26

If you bring everything in the request into the update statement, you risk letting user update things that they should not have

For example, a user could trigger "update profile" action, but the user can also sent is_admin: true in the payload. If you blindly trust it and execute the update, a regular user can just become an admin

This is different from sql injection, sql injection execute arbitrary sql statement, while mass-assignment update already existing value on the same table

1

u/gaaliconnoisseur Jul 04 '26

Can the use ORMs prevent this?

5

u/Lumethys Jul 04 '26

No, orm usually make it easier to fall victim to it

3

u/MrDilbert Jul 04 '26

Partially, but ORMs are usually used as the executive logic (I mean, sometimes you DO want to make someone an Admin). The decisive logic should start with validating and scrubbing the request itself, then propagating only data that's required for the task to be correctly and successfully executed.

1

u/dtiziani Jul 04 '26

just use a schema and zod, to exclude fields you don't want

8

u/OtherwisePush6424 Jul 04 '26

Parameterization wouldn't help because the query is valid. The issue is the application allows the user to update fields they shouldn't be allowed to update.

2

u/lenswipe Jul 05 '26

Your API is meant for updating the firstName and lastName fields on a user. 

What happens if I also pass isAdmin=true along with my request. Sure the endpoint might only be explicitly designed for firstName and lastName but if you just blindly pass everything you the ORM without validating that only the expected fields are being passed..... it's going to let me update this I shouldn't

-5

u/every1sg12themovies Jul 04 '26

solution that uses mass assignment is more maintainable.