The additionalProperties keyword specifies the behavior of properties in an object that are not explicitly defined in the schema. It's often used for defining request or response payloads. By default, the JSON Schema allows additional properties. Setting additionalProperties to true or false indicates if the schema can contain properties other than those defined by the properties map. Setting additionalProperties to true allows any additional properties in the JSON object, even those not defined in the schema. Any additional properties are not validated against the schema. Setting additionalProperties to false prevents any additional properties in the JSON object that are not explicitly defined in the schema. Any additional properties will lead to a validation error.
This rule applies at the API Specification level (OAS/Swagger).
Privilege Escalation: If the API relies on the absence of additional properties for authorization or privilege checks, attackers might exploit this vulnerability to escalate their privileges and gain unauthorized access to restricted resources or perform actions they shouldn't be allowed to.
