How to fix Mass Assignment
in ASP.NET Core
Executive Summary
Mass assignment, often called 'overposting' in the .NET ecosystem, is a vulnerability where the model binder automatically maps HTTP request parameters to internal object properties. If you bind directly to your database entities, an attacker can inject extra JSON fields (e.g., 'IsAdmin': true) to escalate privileges or bypass business logic. As a researcher, this is one of the easiest 'low-hanging fruit' bugs to exploit for full account takeover or privilege escalation.
The Vulnerable Pattern
[HttpPost]
public async Task UpdateProfile(User user)
{
// VULNERABLE: The 'user' object is a database entity.
// An attacker can send { "IsAdmin": true, "Balance": 99999 } in the body.
_context.Users.Update(user);
await _context.SaveChangesAsync();
return NoContent();
} The Secure Implementation
The fix is simple: Never use Domain Entities or Persistence Models as input parameters in your Controller actions. Implement Data Transfer Objects (DTOs) or ViewModels that contain only the fields the user is authorized to change. By using a DTO, you create a strict whitelist. If an attacker sends a property that isn't defined in the DTO, the ASP.NET Core model binder simply ignores it, preventing unauthorized state changes.
public class UserUpdateDto { public string DisplayName { get; set; } public string Bio { get; set; } }[HttpPost] public async Task
UpdateProfile(UserUpdateDto dto) { var userId = User.FindFirstValue(ClaimTypes.NameIdentifier); var user = await _context.Users.FindAsync(userId); if (user == null) return NotFound(); // SECURE: Explicitly mapping only the fields we want to allow user.DisplayName = dto.DisplayName; user.Bio = dto.Bio; await _context.SaveChangesAsync(); return Ok();
}
Your ASP.NET Core API
might be exposed to Mass Assignment
74% of ASP.NET Core apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.