sc-nosqli

SC: NoSQL Injection

Purpose

Detects NoSQL injection vulnerabilities where user-controlled input manipulates NoSQL database queries. Unlike SQL injection, NoSQL injection exploits operator injection, JSON structure manipulation, and JavaScript execution within query contexts. Covers MongoDB, Redis, CouchDB, DynamoDB, and Elasticsearch.

Activation

Called by sc-orchestrator during Phase 2. Runs when NoSQL databases are detected in the architecture.

Phase 1: Discovery

File Patterns to Search

**/*.ts, **/*.js, **/*.py, **/*.php, **/*.java, **/*.go, **/*.cs,
**/models/*, **/controllers/*, **/services/*, **/repositories/*,
**/*mongo*, **/*redis*, **/*elastic*, **/*couch*, **/*dynamo*

Keyword Patterns to Search

# MongoDB
"find(", "findOne(", "findOneAndUpdate(", "findOneAndDelete(",
"aggregate(", "updateOne(", "updateMany(", "deleteOne(", "deleteMany(",
"$where", "$regex", "$gt", "$gte", "$lt", "$lte", "$ne", "$in", "$nin",
"$or", "$and", "$not", "$exists", "$expr",
"MongoClient", "mongoose.model", "collection.find"

# Redis
"redis.get(", "redis.set(", "redis.eval(", "redis.send_command(",
"EVAL ", "EVALSHA", "redis.call("

# Elasticsearch
"client.search(", "client.index(", "query_string",
"script_score", "painless", "elasticsearch"

# CouchDB
"_find", "mango", "cloudant"

Data Flow Tracing

Sources: HTTP request body (JSON), query parameters, headers, cookies

Sinks:

• MongoDB: collection.find(), collection.findOne(), Model.find(), aggregate() — when query object is constructed from user input
• Redis: EVAL with user input in script, redis.send_command() with dynamic commands
• Elasticsearch: query_string query with user input, script fields with user input

Phase 2: Verification

Exploitability Checklist

1. Can the attacker inject MongoDB operators ($gt, $ne, $regex, $where) into the query?
2. Can the attacker modify the query structure by injecting JSON keys?
3. Can the attacker inject JavaScript code into $where or $function expressions?
4. Is the request body parsed as JSON and passed directly to the database driver?