# Detecting and exploiting mass-assignments in order to manipulate user columns and read private messages

Laravel mass assignment on signup and message forms let attacker set arbitrary user/profile columns and a conversation_id to read other users' private messages.

- Payout: unconfirmed
- Severity: high
- Program: -
- Credited: Paul
- Disclosed: 2019-02-05
- Write-up quality: 7/10
- Original: https://dannewitz.ninja/posts/detecting-and-exploiting-mass-assignments
- Library page: https://bugbountylibrary.com/r/blog%3Adannewitz-ninja-posts-detecting-and-exploiting-mass-assignments
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:blog sev:high tech:php technique:fuzzing technique:source-review vuln:access-control vuln:business-logic vuln:dos vuln:idor

**Target:** Laravel web app signup and send-message forms
**Root cause:** Request arrays (user[...], profile[...], mail[conversation_id]) passed directly to Eloquent create without column whitelist, letting attacker set arbitrary DB columns.
**Steps:**
1. Observe bracket-syntax inputs `user[name]`, `user[email]` in signup form indicating mass assignment.
2. Send `user[thisdoesnotexist]=1`; 500 confirms unvalidated column binding.
3. Probe admin columns `user[is_admin]=1`, `is_administrator`, `isAdmin` etc.; 500 responses.
4. Send `user[id]=1`; redirect to error page (duplicate PK) confirms id column exists.
5. Send `user[id]=133333337`; 200, user created.
6. Send `profile[id]=<value>` and confirm reflection in profile source.
7. On message form send `mail[conversation_id]=<random>`; open Sent folder and see third-party message from another conversation.
**How found:** Noticed bracket-syntax form inputs suggesting ORM mass assignment; used 500 vs redirect response differentials to distinguish nonexistent vs existing columns, then brute-forced column names and confirmed via reflected profile id in page source.
**Exploitation:** Attacker registers with injected `user[id]`/`profile[id]` to control primary keys, then submits a message with arbitrary `mail[conversation_id]` to attach to another user's conversation, causing their private messages to render in the attacker's Sent view.
**Escalation:** Chained mass assignment on user/profile id with conversation_id manipulation to pivot from column control to reading other users' private messages; also demonstrated DoS by setting auto-increment id to 4294967295.
**Insight:** Distinguish nonexistent columns (direct 500 from DB) from existing-but-conflicting columns (redirect from duplicate-key) to enumerate schema; then look for secondary forms with hidden id-like fields (conversation_id) where the same unvalidated binding crosses object boundaries.