Lateral movement through malformed JSON schemas can let attackers pivot across services without touching the network.
JSON schema validation is a common guardrail that services use to ensure incoming payloads match an expected shape. The validator runs at the application layer, checking field types, required properties, and structural constraints before the payload is processed.
When a schema itself is under attacker control, either because the service loads schemas from an external store or because the schema is supplied as part of a request, malicious actors can craft a schema that silently rewrites or redirects data. By embedding references to other internal endpoints or by abusing pattern matches, they cause the validated payload to be interpreted as a command for a downstream service. The result is a classic lateral movement scenario: an initial breach gains read/write ability against one component, then uses a poisoned schema to reach additional databases, message queues, or internal APIs.
Traditional perimeter defenses, such as network segmentation or static credentials, do not see this abuse because the traffic stays within the trusted application boundary. The request appears legitimate to the network stack, and the service’s own validator is the source of the malicious transformation. Without a control point that can inspect the schema payload itself, the organization loses visibility into how data is being reshaped and where it is being sent.
Why lateral movement threatens JSON schema validation
The core problem is that schema validation happens after authentication and authorization have already granted the caller access to the service. If the schema can be influenced, the attacker can:
- Inject references that cause the service to fetch secrets from a vault that the attacker does not normally see.
- Rewrite fields so that downstream services treat the data as a command, effectively executing code in another trust domain.
- Bypass field‑level redaction, leaking personally identifiable information to a location the organization has not audited.
Each of these actions is a form of lateral movement: the adversary moves from the initially compromised component to another part of the internal ecosystem, expanding the blast radius without triggering network‑level alerts.
How hoop.dev stops lateral movement in the data path
hoop.dev sits in the data path between the caller and the target service. By acting as an identity‑aware proxy, it can inspect the JSON payload before the service’s own validator runs. The gateway enforces three essential controls:
- Inline schema validation and sanitization. hoop.dev parses incoming JSON, extracts any embedded schema definitions, and applies a policy that rejects schemas containing external references, overly permissive patterns, or constructs that could rewrite data. This prevents a malicious schema from ever reaching the backend.
- Just‑in‑time approval for risky transformations. When a request contains a schema that matches a high‑risk pattern, hoop.dev routes the request to a human approver. The approval workflow is recorded, ensuring that any deviation from the baseline policy is explicitly authorized.
- Session recording and replay. hoop.dev records each session, allowing auditors to query the logs to demonstrate compliance with internal policies and external standards. This audit trail makes it possible to reconstruct an attacker’s path and to prove that the control point prevented the lateral move.
Because hoop.dev is the only point that can see the raw JSON before the target service processes it, the enforcement outcomes exist solely because the gateway is in the data path. Removing hoop.dev would restore the original, vulnerable state where the service alone validates schemas.
Setup: identity and least‑privilege grants
The first layer of defense is identity. Engineers, service accounts, and automated agents authenticate to hoop.dev via OIDC or SAML. The gateway reads group membership and maps it to fine‑grained permissions that define which schemas a principal may submit. This setup decides who can start a request, but it does not enforce the safety of the schema itself.
Enforcement outcomes that matter
With hoop.dev in place, the organization gains:
- Guaranteed blocking of malicious schema constructs before they reach the backend.
- Real‑time human approval for any transformation that could enable lateral movement.
- Session records that auditors can query to demonstrate compliance with internal policies and external standards.
- Automatic masking of sensitive fields in responses, preventing data leakage during a compromised request.
All of these outcomes are produced by hoop.dev because it is the sole gateway that can rewrite, approve, or reject the JSON payload.
Getting started
To protect your services, deploy the gateway using the getting‑started guide. The documentation walks you through configuring OIDC identity, defining schema‑sanitization policies, and enabling the approval workflow. For deeper insight into how hoop.dev applies inline masking and session recording, explore the learn page which details the feature set and best‑practice patterns.
FAQ
What is lateral movement in the context of JSON schema?
It is the technique of using a crafted schema to cause a service to act on data that reaches other internal components, effectively moving the attacker’s foothold from one system to another.
Can hoop.dev block all malicious schemas automatically?
hoop.dev enforces a policy engine that rejects schemas with disallowed constructs. For borderline cases, it can trigger a just‑in‑time approval step, ensuring that no risky transformation proceeds without explicit consent.
Do I need to change my existing services to use hoop.dev?
No. The gateway works at the protocol layer, so existing clients and services continue to use their standard libraries (e.g., HTTP, PostgreSQL, SSH). The only change is routing traffic through the hoop.dev endpoint.
Visit the open‑source repository on GitHub to explore the code and contribute: https://github.com/hoophq/hoop.
