Summary
A mass-assignment vulnerability in the EnergizeLab Eilik NestJS authentication service allows a registered user to submit a user-controlled account identifier during account updates.
If the service accepts that identifier without confirming ownership or authorization, an attacker may change another account's identifying value and take over the account.
A mass-assignment vulnerability in the EnergizeLab Eilik NestJS authentication service allows a registered user to submit a user-controlled account identifier during account updates.
If the service accepts that identifier without confirming ownership or authorization, an attacker may change another account's identifying value and take over the account.
Affected context
The issue occurs in account update functionality where request fields are mapped into account records and the account identifier can be supplied by the client. It becomes risky when the service uses that identifier to select or modify an account without enforcing that the authenticated user owns the target account or has an explicitly authorized administrative role.
The issue occurs in account update functionality where request fields are mapped into account records and the account identifier can be supplied by the client. It becomes risky when the service uses that identifier to select or modify an account without enforcing that the authenticated user owns the target account or has an explicitly authorized administrative role.
Exploit preconditions
- Attack surface: Authenticated account update endpoint
- Required access: A registered user account capable of submitting update requests
- Trigger point: Processing an account update containing a user-controlled account identifier
- Why exploitation is possible: The service may bind client-supplied fields to protected account attributes and fail to enforce object-level authorization for the selected account
- Attack surface: Authenticated account update endpoint
- Required access: A registered user account capable of submitting update requests
- Trigger point: Processing an account update containing a user-controlled account identifier
- Why exploitation is possible: The service may bind client-supplied fields to protected account attributes and fail to enforce object-level authorization for the selected account
Why this happens
The underlying bug is an unsafe request-to-model binding pattern in which client-controlled fields, including an account identifier, are accepted as authoritative update parameters. When the application does not separate permitted profile fields from protected identity fields or does not verify ownership of the target object, a user can influence which account is modified. This behavior maps to CWE-639: Authorization Bypass Through User-Controlled Key, with mass assignment providing the mechanism for supplying the unauthorized key or attribute.
The underlying bug is an unsafe request-to-model binding pattern in which client-controlled fields, including an account identifier, are accepted as authoritative update parameters. When the application does not separate permitted profile fields from protected identity fields or does not verify ownership of the target object, a user can influence which account is modified. This behavior maps to CWE-639: Authorization Bypass Through User-Controlled Key, with mass assignment providing the mechanism for supplying the unauthorized key or attribute.
Potential impact
- An attacker may alter another user's account identifier
- Account takeover may occur if the changed identifier controls login, recovery, or session association
- Users may lose access to their accounts
- Account data or settings could be modified without authorization
- The service could experience broader integrity and trust impacts
- An attacker may alter another user's account identifier
- Account takeover may occur if the changed identifier controls login, recovery, or session association
- Users may lose access to their accounts
- Account data or settings could be modified without authorization
- The service could experience broader integrity and trust impacts
General mitigation guidance
Mitigation generally focuses on reducing client control over account selection and protected attributes.
Common defensive patterns include:
- Deriving the target account from the authenticated session rather than accepting an arbitrary identifier
- Allowlisting mutable fields and excluding identifiers, ownership fields, roles, and recovery attributes from general update binding
- Enforcing object-level authorization before every account read or modification
- Separating administrative update operations from self-service profile updates
- Validating identifiers against the authenticated principal and applying least privilege to service operations
- Requiring additional verification for sensitive identity or recovery changes
Mitigation generally focuses on reducing client control over account selection and protected attributes.
Common defensive patterns include:
- Deriving the target account from the authenticated session rather than accepting an arbitrary identifier
- Allowlisting mutable fields and excluding identifiers, ownership fields, roles, and recovery attributes from general update binding
- Enforcing object-level authorization before every account read or modification
- Separating administrative update operations from self-service profile updates
- Validating identifiers against the authenticated principal and applying least privilege to service operations
- Requiring additional verification for sensitive identity or recovery changes
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules that identify direct binding of request bodies to account or entity models
- Code review checks for client-controlled identifiers in update, delete, and ownership-changing handlers
- Tests that attempt cross-account modifications using authenticated users with ordinary privileges
- API schema and policy checks that prohibit protected fields from self-service operations
- Authorization monitoring for account updates where the requester and target account differ
Automated security review tools may help identify mass-assignment patterns, but endpoint-level authorization tests remain important.
Organizations can look for this class of issue through:
- Static analysis rules that identify direct binding of request bodies to account or entity models
- Code review checks for client-controlled identifiers in update, delete, and ownership-changing handlers
- Tests that attempt cross-account modifications using authenticated users with ordinary privileges
- API schema and policy checks that prohibit protected fields from self-service operations
- Authorization monitoring for account updates where the requester and target account differ
Automated security review tools may help identify mass-assignment patterns, but endpoint-level authorization tests remain important.
