Profile My skills Saved My plugins Edit profile Submit a skill

Privilege Escalation Through Code Logic

Detects code patterns that allow users to elevate their own privileges through API manipulation or mass assignment.

zakirkun Updated
Integrations & APIs

File contents

Privilege Escalation Through Code Logic

Overview

Privilege escalation occurs when users can elevate their own access levels through:

  • Mass assignment: User profile update endpoint accepts role or isAdmin fields
  • Parameter tampering: Changing user_id to another user's ID
  • API parameter forgery: Sending {"role": "admin"} in user update request

Remediation

  • Explicitly whitelist allowed fields in user update operations
  • Never accept role, permission, or admin fields from user-controlled input
  • Verify that any elevation action is performed by a sufficiently privileged user

zakirkun/ice-tea/tree/main/skills/auth/privilege-escalation commit c3260d59da

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/privilege-escalation-through-code-logic