NoSQL Injection

web security databases

Definition

NoSQL Injection (CWE-943)

A NoSQL injection occurs when a NoSQL query (typically a JSON object in SQL-free stores such as MongoDB) is built from unsanitised user input. Because the query language accepts operators such as $ne (not equal) as values within the query object, an attacker who controls the shape of a parameter can make the query match unintended documents.

Example: Login Bypass

Example

The application builds a query from POST parameters:

$query = new MongoDB\Driver\Query([
    'mail'     => $_POST['mail'],
    'password' => $_POST['password'],
]);

The attacker sends the body

mail=marco@example.at&password[$ne]=wrongpassword

PHP interprets password[$ne] as an array {"$ne": "wrongpassword"}, so the query matches any document whose password is not wrongpassword — i.e. every account. The login is bypassed.

Blind NoSQLi uses the same trick with operators like $regex or $gt to mount a char-by-char leak analogous to blind SQLi.