VNX-915: Mass assignment: the whole request body is written onto a model

Field	Value
Rule ID	VNX-915
Severity	High
SARIF level	error
Kind	sast
Languages	JavaScript / TypeScript
CWE	CWE-915
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H
Tags	mass-assignment cwe-915
Source	internal/sast/rules/vnx-915.rego

Overview

The request body is copied wholesale onto a persistent object, so a client can set any field the model has (role, isAdmin, price, ownerId). In JavaScript/TypeScript the rule reports Object.assign(target, req.body), new Model(req.body), ORM writes (create, insert*, update*, findByIdAndUpdate, upsert, set, merge) given req.body, req.body.<member>, req.query or ctx.request.body directly or spread into an object literal, Prisma data: req.body, MongoDB { $set: req.body }, and the same through a variable assigned from the body.

Ruby mass assignment (.permit!, ActiveRecord new/create/update/assign_attributes given a raw params[:key] or params.to_unsafe_h, and a permit(...) list that admits a privilege attribute) is the same weakness and is reported by VNX-RUBY-006, not here, so a Rails controller line is not reported twice.

Why This Matters

Fields the form never offers are still accepted: a sign-up request that adds "role": "admin" or an order update that sets its own price succeeds.

What Gets Flagged

const p = await Product.create(req.body);
const other = await Account.create({ ...req.body, owner: req.user.id });

Not flagged: explicit fields (create({ name: req.body.name })), bodies filtered through pick/omit or a validator, Object.assign({}, ...) copies, hash/HMAC update(), built-in constructors, comments and strings. Ruby files are left to VNX-RUBY-006.

Remediation

Copy the allowed fields explicitly, or validate the body against a schema that strips unknown keys.

References

• CWE-915
• OWASP Mass Assignment Cheat Sheet

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-915
// nosec vnx-915

Or record an ignore rule: vulnetix ignore add --rule vnx-915 --reason "...". See Suppressing findings.