The Hidden Weapon: How I Turn Mass Assignment into Bounties
This article discusses a Mass Assignment vulnerability, where unsanitized user input is assigned to unintended attributes. The flaw in the application was not properly validating or filtering input data during the creation and updating of objects, allowing attackers to manipulate sensitive fields without authentication. By injecting additional parameters into POST requests, the researcher exploited this vulnerability to change passwords, access restricted areas, and escalate privileges. The attack worked due to lax input sanitization, which failed to check for unexpected attributes in user submissions. This issue resulted in unauthorized access and potential data breaches. The researcher received a $10,000 bounty from the program. To prevent such issues, developers should validate user inputs using white lists, sanitize inputs with regular expressions, and employ object-level permission controls. Key lesson: Always validate and filter user inputs to prevent unauthorized data manipulation #BugBounty #Cybersecurity #WebSecurity #MassAssignment

https://medium.com/@0xuserm9/the-hidden-weapon-how-i-turn-mass-assignment-into-bounties-459d7c35a727?source=rss------bug_bounty-5

Badaczom udało się zhakować Formułę 1 i “wykraść” paszport Verstappena

Jedną z fajniejszych, z punktu widzenia pentestera, podatności (chociaż trochę niedoceniana) jest podatność masowego przypisania (mass assignment). Dzięki niej, możliwa jest zmiana np. pól obiektu, które nie powinny zostać zmienione. Powstaje najczęściej w wyniku błędnego użycia funkcjonalności np. biblioteki, która pozwala zmapować parametry zapytania do wewnętrznej reprezentacji obiektu w aplikacji. ...

#WBiegu #F1 #MassAssignment #Podatność #Websec

https://sekurak.pl/badaczom-udalo-sie-zhakowac-formule-1-i-wykrasc-paszport-verstappena/

Mass Assignment Vulnerability Exposes Max Verstappen Passport and F1 Drivers PII

https://ian.sh/fia

#HackerNews #MassAssignment #Vulnerability #MaxVerstappen #F1Drivers #PII #Cybersecurity #DataBreach