hunting-nosql-operator-and-where-injection

Hunting NoSQL operator and where injection: when a value arrives as an operator

NoSQL injection rarely looks like classic SQL injection because there is no string to concatenate. Instead, a document store filter is often built directly from a request object, so if the attacker sends an object where the code expected a scalar, its keys become query operators. A login check that compares a password to a request field can be turned always-true by sending an operator that matches anything. Worse, some stores evaluate server-side JavaScript, in a $where clause, a mapReduce function, or an aggregation expression, and untrusted input reaching that path is code execution inside the database. You find these by separating filters that bind scalar values from those that accept a request-shaped object or an expression, and tracing untrusted input into the latter.

When to use

• Data access uses a document, key-value, or wide-column store with request-built query filters.
• A request field expected to be a scalar could arrive as an object whose keys become operators.
• Untrusted input can reach a server-side JavaScript evaluation: $where, mapReduce, or an aggregation.

Scope check

Test NoSQL injection only against databases and applications you own or are authorized to assess, on non-production data. A confirming operator or expression can read or alter records outside the intended scope, so stay inside the authorized boundary. If you can't name the authorization, stop.

The loop

1. Establish the query sinks and split them. Inventory where the store is queried, then separate calls that bind scalar values from calls that accept a request-shaped filter object or evaluate a server-side expression. This is the false-positive killer: a query with typed scalar parameters cannot be operator- injected. Name the structure-accepting and expression-evaluating sinks first.

2. Trace untrusted input into filter objects. Follow request bodies and query strings into filters built from them. The key question is whether a field expected to be a scalar can arrive as an object: if the code does find({ user: req.body.user }) and req.body.user can be an object, the attacker sends an operator that changes the match. Confirm whether the value is type-checked to a scalar before use.