Mass Assignment Vulnerability in OopsSec Store Registration Form

The article describes a "mass assignment" vulnerability in the registration form of the OopsSec Store. This flaw allows an attacker to inject an unauthorized field into the registration request to create an account with administrative privileges. The attack is carried out by intercepting the registration request, adding a role field with the value ADMIN, and submitting the modified request. The backend stores all received fields without validation, allowing the attacker to access restricted functionalities. The vulnerability is due to the lack of field filtering in the backend, which uses the spread operator to copy all properties from the request. The remediation includes explicitly extracting the expected fields and validating inputs with a schema.