NoSQL Injection

Also Known As

TL;DR

Explanation

NoSQL injection is the document-store equivalent of SQL injection, but with attack vectors specific to each engine. In MongoDB, the most common patterns are: operator injection where attacker input becomes a query operator object (e.g. submitting `{"$ne": null}` as a password to bypass a `find({user, password})` query); JavaScript injection via the `$where` operator or `mapReduce`, which executes attacker-controlled JS server-side; and array/object payload injection in fields the application expects to be strings. Redis vulnerabilities cluster around `EVAL`, `SCRIPT LOAD`, and command injection through unvalidated arguments to Lua scripts. Couchbase and other engines have N1QL injection that closely mirrors SQL injection. The unifying defence is the same as SQL: never concatenate untrusted input into queries; use parameterised query builders, type-cast inputs to expected scalar types before query construction, and validate that JSON inputs match a strict schema. PHP's MongoDB driver (`mongodb/mongodb`) accepts BSON arrays — type-casting `$_POST` values to strings before passing them to a query is a critical defensive step.

How It's Exploited

Watch Out

Common Misconception

Why It Matters

Common Mistakes

• Passing `$_POST` arrays straight into MongoDB queries — PHP arrays serialize to BSON objects, turning user input into operator structure.
• Using `$where` with concatenated user input — equivalent to executing attacker-controlled JavaScript server-side.
• Assuming JSON parsing sanitises input — `json_decode` happily produces nested arrays that become query operators.
• Treating Redis as injection-free — `EVAL` with concatenated arguments, or commands constructed from user input, are RCE-class vulnerabilities.
• Filtering only string-keys without filtering values — operator injection happens through values that contain keys starting with `$`.

Avoid When

• Code uses a typed query-builder with parameterised values and no raw arrays — validate that's actually the case before assuming safety.

When To Use

• Reviewing any PHP code that builds MongoDB or Redis queries from request input.
• Auditing authentication, search, and update endpoints in document-store applications.
• Setting up CI rules to catch direct $_POST/$_GET use in query construction.

Code Examples

// ❌ MongoDB query built from raw $_POST — accepts operator injection
$user = $collection->findOne([
    'username' => $_POST['username'],
    'password' => $_POST['password']
]);
// Attacker submits password[$ne]=x — matches any non-'x' password.
// Authentication bypass is one form post away.

// ✅ Cast to scalar string and validate — operator structure cannot survive
$username = (string) ($_POST['username'] ?? '');
$password = (string) ($_POST['password'] ?? '');

if ($username === '' || $password === '' || strlen($password) > 1024) {
    throw new InvalidArgumentException('Invalid credentials format');
}

$user = $collection->findOne([
    'username' => $username,
    'password' => password_verify_lookup($password)
]);

// For arbitrary user input that must be JSON, validate against a schema
// (e.g. opis/json-schema) before passing fields to the query builder.

References

• ↗ https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection
• ↗ https://www.mongodb.com/docs/manual/core/security-mitigation/

Tags

Related Terms