HighA05:2025CWE-943Injection

NoSQL Injection

NoSQL Injection targets NoSQL databases (MongoDB, CouchDB, Redis) by injecting malicious operators or queries through application inputs. Unlike SQL injection, it exploits JSON/BSON query structures rather than SQL syntax.

Overview

NoSQL injection attacks exploit vulnerabilities in NoSQL database queries similar to how SQL injection exploits relational databases. As NoSQL databases like MongoDB, CouchDB, and Cassandra have grown in popularity, so have attacks targeting their query languages. Attackers inject operators like $gt, $ne, $regex, or $where into queries to bypass authentication, extract data, or modify records.

Types & Variants

Operator Injection

Injecting MongoDB operators ($gt, $ne, $regex) into query parameters to alter query logic.

JavaScript Injection

Injecting JavaScript code via the $where operator or map-reduce functions in MongoDB.

Impact

Authentication bypass, data extraction, data manipulation, denial of service against the database.

Examples

MongoDB Auth Bypass

{"username": {"$ne": ""}, "password": {"$ne": ""}}

$regex Data Extraction

{"username": "admin", "password": {"$regex": "^a"}}

Remediation

Validate and sanitize all inputs, use type checking, avoid building queries from string concatenation, use ODM/ORM query builders, and implement query depth limits.

Validate input types strictly (reject objects when strings expected)

Use ODM libraries with built-in sanitization (Mongoose, etc.)

Disable server-side JavaScript execution in MongoDB ($where)

Implement query depth and complexity limits

Use RBAC and least-privilege database access