T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/api-development/SKILL.md:69- Finding
Unauthenticated User Registration Allows Administrative Role Assignment
- Content
View full analysis
{ try { const user = await userService.create(req.body) res.status(201).json(user) } catch (err) { next(err) } } ) ``` ```typescript export const createUserSchema = z.object({ body: z.object({ email: z.string().email('Invalid email format'), name: z.string().min(1, 'Name is required').max(100), password: z.string() .min(8, 'Password must be at least 8 characters') .regex(/[A-Z]/, 'Password must contain uppercase') .regex(/[0-9]/, 'Password must contain number'), role: z.enum(['user', 'admin']).default('user'), }), }) ``` ### Technical Analysis The example exposes `POST /users` without authentication or authorization middleware. Its validation schema permits the caller to submit either `user` or `admin` as the account role. The complete validated request body is then passed directly to `userService.create()`. A default value of `user` does not prevent exploitation because it is only applied when the caller omits the field. An attacker can explicitly provide `"role": "admin"`, which passes schema validation. This is an insecure mass-assignment pattern and violates the rule that authorization-sensitive properties must be assigned exclusively by trusted server-side logic. Because this Skill is intended to provide reusable production templates, applications adopting the example without correction may inherit the vulnerability. ### Attack Path 1. An unauthenticated attacker identifies the public `POST /users` endpoint. 2. The attacker submits a request such as: ```json { "email": "attacker@example.com", "na ...[truncated 843 chars]- Remediation
View remediation