ruby-json-pollution

name

ruby-json-pollution

description

Use this skill whenever you're testing Ruby on Rails applications for deserialization vulnerabilities, JSON parsing issues, or authorization bypasses involving the _json parameter. Trigger this when you see JSON endpoints, Rails controllers, or need to test for parameter pollution attacks. Make sure to use this skill for any web application security testing involving Ruby backends, especially when dealing with JSON request bodies, API endpoints, or authorization checks.

Ruby _json Pollution Attack

A skill for identifying and exploiting the Ruby _json pollution vulnerability in Rails applications.

Overview

The _json pollution vulnerability occurs when Ruby on Rails applications handle non-hashable values (like arrays) in JSON request bodies. When such values are encountered, Rails stores them in a special _json key. Attackers can manually inject this _json parameter to bypass authorization checks or manipulate application behavior.

Vulnerability Mechanics

How It Works

1. Normal behavior: When Rails receives a JSON body with non-hashable values (arrays, etc.), it automatically stores them in a _json key
2. Attack vector: An attacker can manually include _json in the request body with arbitrary values
3. Exploitation: If the application checks one parameter for authorization but uses _json for actual operations, the check can be bypassed

Example Payload

{
  "id": 123,
  "_json": [456, 789]
}

In this case, the array [456, 789] would be accessible via the _json key in the Rails controller.

Detection

When to Test

• Any Ruby on Rails application with JSON API endpoints
• Applications that accept JSON request bodies
• Endpoints with authorization or access control checks
• Forms or APIs that process structured data

Detection Steps

1. Identify JSON endpoints: Find API endpoints that accept JSON in the request body
2. Check for parameter validation: Look for endpoints that validate specific parameters
3. Test _json injection: Add a _json key with test values to the request body
4. Observe behavior: Check if the application processes the _json parameter

Example Detection Request

curl -X POST https://target.com/api/resource \
  -H "Content-Type: application/json" \
  -d '{
    "id": 1,
    "_json": {"test": "pollution_detected"}
  }'

Exploitation

Authorization Bypass

If an application checks params[:id] for authorization but uses params[:_json] for the actual operation:

{
  "id": 1,  // User's own resource (passes auth check)
  "_json": [999]  // Target resource (used for actual operation)
}

Data Manipulation

Inject arbitrary data structures through _json:

{
  "action": "update",
  "_json": {
    "role": "admin",
    "permissions": ["read", "write", "delete"]
  }
}

Array Injection

Force array values into the parameter hash:

{
  "user_id": 123,
  "_json": [123, 456, 789]
}

Testing Checklist

• Identify all JSON API endpoints
• Map parameters used for authorization checks
• Test each endpoint with _json parameter injection
• Compare behavior with and without _json parameter
• Document any differences in application behavior
• Check for sensitive operations affected by _json

Mitigation Recommendations

For Developers

1. Explicit parameter whitelisting: Only allow specific parameters in controllers
2. Avoid relying on implicit parameter handling: Be explicit about what data is accepted
3. Validate all input: Check both explicit parameters and any _json keys
4. Use strong parameters: Leverage Rails strong parameters feature
5. Sanitize JSON input: Remove or validate _json keys before processing

Example Strong Parameters

def permitted_params
  params.permit(:id, :name, :email)
  # _json is not permitted
end

References

• Rails _json Juggling Attack - Nastystereo
• HackTricks - Ruby _json Pollution

Related Skills

• Consider using this skill alongside other deserialization testing skills
• Combine with general API security testing for comprehensive coverage
• Use with authorization testing skills for complete access control assessment