NoSQL Injection

NoSQL injection exploits databases that don't use traditional SQL syntax—like MongoDB, CouchDB, or Redis—by manipulating queries through unsanitized user input. Unlike SQL injection, attackers target JSON objects, operator syntax, and language-specific features. In MongoDB, for instance, an attacker might inject operator objects like {"$ne": null} into a login form where the application expects a simple string. If the backend constructs queries by directly merging user input into query objects, the injected operator transforms the query logic entirely.

Two primary attack vectors exist: operator injection and syntax injection. Operator injection abuses NoSQL-specific operators—$where, $ne, $gt, $regex—to alter query behavior. An authentication check expecting {username: "admin", password: "secret"} becomes {username: {"$ne": null}, password: {"$ne": null}}, matching any existing user. Syntax injection breaks out of the intended query structure, often by closing delimiters or injecting raw JavaScript when databases allow it (like MongoDB's $where clause).

Attackers typically probe by submitting JSON objects instead of strings, testing how the application processes structured input. They escalate by chaining operators to extract data character-by-character using regex patterns, or execute arbitrary JavaScript through $where clauses if the database allows server-side code evaluation.

• Authentication bypass: Force login logic to return true by injecting operators that always match
• Unauthorized data access: Extract entire collections by manipulating query conditions to return all records
• Blind data exfiltration: Use regex operators to extract sensitive data one character at a time through timing or response differences
• Denial of service: Trigger resource-intensive operations with malicious $where clauses or regex patterns
• Remote code execution: Execute arbitrary JavaScript on database servers that evaluate $where expressions

A vulnerability in Parse Server (CVE-2019-5418) allowed attackers to bypass authentication by injecting MongoDB query operators through the password reset mechanism. By submitting an object with comparison operators instead of a password string, attackers could reset arbitrary user accounts without knowing credentials.

Several REST API frameworks demonstrated NoSQL injection when deserializing JSON without validation. Attackers sent requests with payloads like {"username": {"$gt": ""}} to administrative endpoints, causing the application to return all users instead of checking specific credentials. This pattern affected multiple Node.js applications using Mongoose without proper schema validation.

E-commerce platforms running MongoDB experienced data breaches where attackers used $regex injection to enumerate customer records. By systematically testing partial matches through URL parameters converted to query operators, they extracted email addresses and order histories without triggering traditional SQL injection defenses.

• Use ODM/schema validation: Employ frameworks like Mongoose with strict schemas that reject unexpected operators
• Type-check all inputs: Ensure user-supplied values match expected primitive types before query construction
• Whitelist allowed fields: Only permit known-safe JSON keys in query objects, reject any operator syntax
• Disable JavaScript execution: Turn off $where and similar features that evaluate code on the database server
• Apply least privilege: Use database accounts with minimal permissions, restricting access to sensitive collections
• Sanitize operators: Strip or escape characters like $ and . from user input before processing