Possible dangerous permitted parameter key

Description

Permitting high-risk parameter keys in Rails applications exposes them to mass assignment vulnerabilities.

In Rails, mass assignment is when we use a hash to assign attributes all at once rather than individually. This feature is often used for creating or updating records.

When used with an untrusted hash (for example, the params hash in a controller), mass assignment is open to attack because any attribute on the record that corresponds to a key in the hash will be automatically assigned the value in the hash. An attacker could exploit this vulnerability to change their role and permissions or to assign themselves as an admin.

By default, Rails' strong parameters protect against mass assignment vulnerability. However, the inclusion of sensitive or high-risk keys in the permitted list can still leave the application vulnerable.

Remediations

  • Do not include high-risk parameters such as :admin or :role in the list of permitted keys for mass assignment, to prevent attackers from exploiting these attributes to escalate their privileges.
    user_params = params.require(:user).permit(:admin, :role) # unsafe
  • Do not use mass assignment with an untrusted hash, such as params.
    User.new(params) # unsafe

References

Associated CWE

OWASP Top 10

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=ruby_rails_unsafe_mass_assignment

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=ruby_rails_unsafe_mass_assignment