GuardAPI Logo
GuardAPI

Fix Mass Assignment in Micronaut

Mass assignment in Micronaut occurs when the framework's data binding automatically maps HTTP request parameters directly to internal domain models or JPA entities. Without a strict schema or input filter, an attacker can overwrite sensitive fields—like 'role', 'is_admin', or 'account_balance'—by simply including them in the JSON payload. As a researcher, I see this regularly when developers prioritize 'clean code' over 'secure architecture' by reusing entities for transport.

The Vulnerable Pattern

@Post("/register")
public HttpResponse register(@Body User user) {
    // VULNERABLE: The framework binds any JSON key to the User entity fields.
    // An attacker sends: {"username":"hacker", "isAdmin": true}
    return HttpResponse.created(userRepository.save(user));
}

@Entity
public class User {
@Id @GeneratedValue private Long id;
private String username;
private String password;
private boolean isAdmin; // This is the target for mass assignment
}

The Secure Implementation

The fix leverages the DTO (Data Transfer Object) pattern combined with Micronaut's @Introspected annotation. By decoupling the transport layer from the persistence layer, you create an explicit whitelist. The Micronaut binder only maps fields present in the DTO. Even if an attacker injects 'isAdmin': true into the HTTP body, the DTO lacks that property, and the value is ignored. For further hardening, use 'final' fields in DTOs and avoid 'setters' on sensitive Entity fields where possible.

@Post("/register")
public HttpResponse register(@Body @Valid UserRegistrationDTO dto) {
    // SECURE: Use a Data Transfer Object (DTO) to define a strict whitelist.
    User user = new User();
    user.setUsername(dto.getUsername());
    user.setPassword(passwordEncoder.encode(dto.getPassword()));
    // isAdmin is never touched during the binding process
    return HttpResponse.created(userRepository.save(user));
}

@Introspected
public class UserRegistrationDTO {
@NotBlank private String username;
@NotBlank private String password;
// No ‘isAdmin’ field exists here, preventing injection.
public String getUsername() { return username; }
public String getPassword() { return password; }
}

System Alert • ID: 2679
Target: Micronaut API
Potential Vulnerability

Your Micronaut API might be exposed to Mass Assignment

74% of Micronaut apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.

RUN FREE SECURITY DIAGNOSTIC
GuardLabs Engine: ONLINE

Free Tier • No Credit Card • Instant Report

Verified by Ghost Labs Security Team

This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.

About GuardLabs → Follow us on X