Three new Ruby challenges, Including JSON smuggling

We have released three new challenges in the Ruby game: Chapar Khaneh Manifest.rb, Chapar Archive.rb and Divan Export.rb.

Chapar Khaneh Manifest.rb is built on the Rails _json juggling attack, published in December 2024.

Rails always hands a controller a Hash-like params. When a JSON body is not a Hash, such as an array, Rails wraps it under a _json key. Nothing stops a client from sending that key itself.

So one request can be valid in two shapes. Deleting one item takes {"id": 123}. Deleting several takes [456, 789], which Rails turns into {"_json": [456, 789]}. This body satisfies both:

{"id": 123, "_json": [456, 789]}

If the authorisation check reads the multi-item form and the delete reads the single-item form, the check approves one set of ids and the action deletes another. The bug exists only where the two disagree, so both have to read the same parameter.

Play them in the Ruby game: Play - SecDim