Collected research
The Ruby on Rails _json Juggling Attack
Rails wraps a non-hash JSON body into params under a reserved key but never blocks a request that supplies that key itself, so one body can carry both the single-item hash form and the multi-item array form at once. Where authorisation code and action code read different forms of the same request, the mismatch gives an authorisation bypass.
Record
- Researcher
- Luke Jahnke
- Published by
- nastystereo.com
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Luke Jahnke, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .