English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Mass assignment is one of the most prominent vulnerabilities in RESTful APIs.This vulnerability originates from a misconfiguration in common web frameworks,such that naming convention and automatic binding can be exploited by anattacker to craft malicious requests writing confidential resources and(massively) overriding data, that should be read-only and/or confidential. Inthis paper, we adopt a black-box testing perspective to automatically detectmass assignment vulnerabilities in RESTful APIs. Execution scenarios aregenerated purely based on the OpenAPI specification, that lists the availableoperations and their message format. Clustering is used to group similaroperations and reveal read-only fields, the latter are candidate for massassignment. Then, interaction sequences are automatically generated byinstantiating abstract testing templates, trying to exploit the potentialvulnerabilities. Finally, test cases are run, and their execution is assessedby a specific oracle, in order to reveal whether the vulnerability could besuccessfully exploited. The proposed novel approach has been implemented andevaluated on a set of case studies written in different programming languages.The evaluation highlights that the approach is quite effective in detectingseeded vulnerabilities, with a remarkably high accuracy.

Automated Black-box Testing of Mass Assignment Vulnerabilities in RESTful APIs