Exploiting a mass assignment vulnerability

Platform: PortSwigger | Category: API testing | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, API testing

Summary

Walkthrough of the PortSwigger Web Security Academy lab Exploiting a mass assignment vulnerability (API testing). This lab demonstrates a api testing vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — API testing

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Overview :

Mass assignment vulnerabilities

Mass assignment (also known as auto-binding) can inadvertently create hidden parameters. It occurs when software frameworks automatically bind request parameters to fields on an internal object. Mass assignment may therefore result in the application supporting parameters that were never intended to be processed by the developer.

Identifying hidden parameters

Since mass assignment creates parameters from object fields, you can often identify these hidden parameters by manually examining objects returned by the API.

For example, consider a PATCH /api/users/ request, which enables users to update their username and email, and includes the following JSON:

 json read-only • copy allowed Copy
{
    "username": "wiener",
    "email": "wiener@example.com",
}

A concurrent GET /api/users/123 request returns the following JSON:

 json read-only • copy allowed Copy
{
    "id": 123,
    "name": "John Doe",
    "email": "john@example.com",
    "isAdmin": "false"
}

This may indicate that the hidden id and isAdmin parameters are bound to the internal user object, alongside the updated username and email parameters.

Testing mass assignment vulnerabilities To test whether you can modify the enumerated isAdmin parameter value, add it to the PATCH request:

 json read-only • copy allowed Copy
{
    "username": "wiener",
    "email": "wiener@example.com",
    "isAdmin": false,
}

In addition, send a PATCH request with an invalid isAdmin parameter value:

 json read-only • copy allowed Copy
{
    "username": "wiener",
    "email": "wiener@example.com",
    "isAdmin": "foo",
}

If the application behaves differently, this may suggest that the invalid value impacts the query logic, but the valid value doesn't. This may indicate that the parameter can be successfully updated by the user.

You can then send a PATCH request with the isAdmin parameter value set to true, to try and exploit the vulnerability:

 json read-only • copy allowed Copy
{
    "username": "wiener",
    "email": "wiener@example.com",
    "isAdmin": true,
}

If the isAdmin value in the request is bound to the user object without adequate validation and sanitization, the user wiener may be incorrectly granted admin privileges. To determine whether this is the case, browse the application as wiener to see whether you can access admin functionality.

Solution :

Login as wiener using the provided credentials - wiener:peter

Add the leather jacket to cart. Now while checkout, the broswer sends the following API request.

Since the response is in JSON format, to exploit a Mass Assignment vulnerability, we need to change the request method to JSON using Content-Type Converter.

Now when I send the following JSON body with a dicount percentage, I get an error emssage.

But when I provide the entire JSON body which I got in the first response, the request is successfull.

Now in the checkout page we can see that the discount has been applied successfully & thus the lab is solved.

Key Takeaways / Lessons

• Understanding API testing detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Exploiting a mass assignment vulnerability