# Ruby JSON Pollution

> Use this skill whenever you're testing Ruby on Rails applications for deserialization vulnerabilities, JSON parsing issues, or authorization bypasses involving the _json parameter. Trigger this when you see JSON endpoints, Rails controllers, or need to test for parameter pollution attacks. Make sure to use this skill for any web application security testing involving Ruby backends, especially when dealing with JSON request bodies, API endpoints, or authorization checks.

- Skill: `abelrguezr/ruby-json-pollution` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/ruby-json-pollution`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/ruby-json-pollution/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/ruby-json-pollution

---


# Ruby _json Pollution Attack

A skill for identifying and exploiting the Ruby _json pollution vulnerability in Rails applications.

## Overview

The `_json` pollution vulnerability occurs when Ruby on Rails applications handle non-hashable values (like arrays) in JSON request bodies. When such values are encountered, Rails stores them in a special `_json` key. Attackers can manually inject this `_json` parameter to bypass authorization checks or manipulate application behavior.

## Vulnerability Mechanics

### How It Works

1. **Normal behavior**: When Rails receives a JSON body with non-hashable values (arrays, etc.), it automatically stores them in a `_json` key
2. **Attack vector**: An attacker can manually include `_json` in the request body with arbitrary values
3. **Exploitation**: If the application checks one parameter for authorization but uses `_json` for actual operations, the check can be bypassed

### Example Payload

```json
{
  "id": 123,
  "_json": [456, 789]
}
```

In this case, the array `[456, 789]` would be accessible via the `_json` key in the Rails controller.

## Detection

### When to Test

- Any Ruby on Rails application with JSON API endpoints
- Applications that accept JSON request bodies
- Endpoints with authorization or access control checks
- Forms or APIs that process structured data

### Detection Steps

1. **Identify JSON endpoints**: Find API endpoints that accept JSON in the request body
2. **Check for parameter validation**: Look for endpoints that validate specific parameters
3. **Test _json injection**: Add a `_json` key with test values to the request body
4. **Observe behavior**: Check if the application processes the `_json` parameter

### Example Detection Request

```bash
curl -X POST https://target.com/api/resource \
  -H "Content-Type: application/json" \
  -d '{
    "id": 1,
    "_json": {"test": "pollution_detected"}
  }'
```

## Exploitation

### Authorization Bypass

If an application checks `params[:id]` for authorization but uses `params[:_json]` for the actual operation:

```json
{
  "id": 1,  // User's own resource (passes auth check)
  "_json": [999]  // Target resource (used for actual operation)
}
```

### Data Manipulation

Inject arbitrary data structures through `_json`:

```json
{
  "action": "update",
  "_json": {
    "role": "admin",
    "permissions": ["read", "write", "delete"]
  }
}
```

### Array Injection

Force array values into the parameter hash:

```json
{
  "user_id": 123,
  "_json": [123, 456, 789]
}
```

## Testing Checklist

- [ ] Identify all JSON API endpoints
- [ ] Map parameters used for authorization checks
- [ ] Test each endpoint with `_json` parameter injection
- [ ] Compare behavior with and without `_json` parameter
- [ ] Document any differences in application behavior
- [ ] Check for sensitive operations affected by `_json`

## Mitigation Recommendations

### For Developers

1. **Explicit parameter whitelisting**: Only allow specific parameters in controllers
2. **Avoid relying on implicit parameter handling**: Be explicit about what data is accepted
3. **Validate all input**: Check both explicit parameters and any `_json` keys
4. **Use strong parameters**: Leverage Rails strong parameters feature
5. **Sanitize JSON input**: Remove or validate `_json` keys before processing

### Example Strong Parameters

```ruby
def permitted_params
  params.permit(:id, :name, :email)
  # _json is not permitted
end
```

## References

- [Rails _json Juggling Attack - Nastystereo](https://nastystereo.com/security/rails-_json-juggling-attack.html)
- [HackTricks - Ruby _json Pollution](https://book.hacktricks.xyz/pentesting-web/deserialization/ruby-_json-pollution)

## Related Skills

- Consider using this skill alongside other deserialization testing skills
- Combine with general API security testing for comprehensive coverage
- Use with authorization testing skills for complete access control assessment