Exploiting CBC-mode encryption and messy JSON parsers

Padding oracle with extra steps?

A classical Padding Oracle attack