NoSQL Injection Testing Skill

Purpose

Validate NoSQL injection vulnerabilities by injecting special operators, JavaScript code, or malformed queries into user-controlled inputs and observing:

• •Authentication bypass via operator injection ($ne, $gt, $regex)
• •Data exfiltration via query manipulation
• •JavaScript execution in databases supporting server-side JS ($where, mapReduce)
• •Boolean-based inference by comparing response differences
• •Time-based inference via heavy operations or sleep-like constructs

Vulnerability Types Covered

1. Operator Injection (CWE-943)

Inject MongoDB query operators to manipulate query logic.

Detection Methods:

• •{"$ne": ""} — not equal empty, bypasses equality checks
• •{"$gt": ""} — greater than empty, returns all matching documents
• •{"$regex": ".*"} — regex wildcard match
• •{"$or": [...]} — logical OR injection

Example Attack:

// Normal: {"username": "admin", "password": "secret"}
// Attack: {"username": "admin", "password": {"$ne": ""}}
// Effect: Returns admin user regardless of password

2. JavaScript Injection (CWE-943)

Inject JavaScript in databases supporting server-side execution.

Detection Methods:

• •$where clause injection: {"$where": "this.password.length > 0"}
• •mapReduce function injection
• •$function aggregation operator (MongoDB 4.4+)

Example Attack:

// Payload: {"$where": "sleep(5000) || true"}
// Effect: 5-second delay if JS execution enabled

3. Array/Object Injection (CWE-943)

Exploit type confusion when arrays or objects are passed where strings expected.

Detection Methods:

• •username[$ne]= via query string (Express.js extended query parser)
• •Array index manipulation: items[0]=malicious

4. Aggregation Pipeline Injection (CWE-943)

Inject into MongoDB aggregation pipelines.

Detection Methods:

• •$lookup injection for cross-collection access
• •$out or $merge for write operations
• •$group manipulation for data extraction

Database-Specific Notes

Prerequisites

• •Target reachable; NoSQL-backed functionality identified (API endpoints, forms, JSON bodies)
• •Know (or infer) database type to select appropriate payloads
• •If authentication required: test accounts available or mark paths UNVALIDATED
• •VULNERABILITIES.json with suspected NoSQLi findings if provided

Testing Methodology

Phase 1: Identify Injection Points

• •JSON POST bodies (most common for NoSQL APIs)
• •URL query parameters (especially with extended query parsers)
• •HTTP headers (authorization tokens, custom headers)
• •Path parameters

Key Insight: NoSQL APIs typically accept JSON; look for object/array inputs where operators can be injected.

Phase 2: Establish Baseline

• •Send a normal request; record status, content, and response time
• •Note authentication/authorization behavior
• •Identify error message patterns

Phase 3: Execute NoSQL Injection Tests

Operator Injection (Authentication Bypass):

# Baseline
baseline = post("/login", json={"username": "admin", "password": "wrong"})
# Expected: 401 Unauthorized

# Test with $ne operator
test = post("/login", json={"username": "admin", "password": {"$ne": ""}})
# If 200 OK: VALIDATED - operator injection bypassed auth

Operator Injection (Data Extraction):

# Baseline
baseline = get("/api/users?role=user")
# Expected: Returns only users with role="user"

# Test with $gt operator
test = get("/api/users?role[$gt]=")
# If returns more users: VALIDATED - operator injection expanded query

Boolean-Based Inference:

# True condition
true_resp = post("/api/search", json={"name": {"$regex": "^a"}})
# False condition
false_resp = post("/api/search", json={"name": {"$regex": "^zzzzz"}})
# Compare response lengths/content
if len(true_resp.text) != len(false_resp.text):
    status = "VALIDATED"

JavaScript Injection (if enabled):

# Time-based test
baseline_time = measure(post("/api/query", json={"filter": "normal"}))
test_time = measure(post("/api/query", json={"$where": "sleep(5000) || true"}))
if test_time > baseline_time + 4.5:
    status = "VALIDATED"

Phase 4: Classification Logic

Phase 5: Capture Evidence

Capture minimal structured evidence (redact PII/secrets, truncate to 8KB, hash full response):

• •status, injection_type, cwe
• •Baseline request (url/method/status/body hash)
• •Test request (url/method/status/body hash)
• •Payload used
• •Authentication bypass details if applicable

Phase 6: Safety Rules

• •Detection-only payloads; never destructive operations ($out, db.dropDatabase())
• •Avoid data exfiltration; use boolean/time-based confirmation
• •Do not execute arbitrary JS that modifies data
• •Respect rate limits
• •Redact credentials, tokens, and personal data in evidence

Output Guidelines

• •Keep responses concise (1-4 sentences)
• •Include endpoint, payload, detection method, and impact

Validated examples:

NoSQL injection on /login - $ne operator bypassed password check (CWE-943). Admin access without credentials.
MongoDB $where injection on /api/search - sleep(5000) caused 5.1s delay (CWE-943). Server-side JS execution confirmed.
Operator injection on /api/users - $gt operator returned all users instead of filtered set (CWE-943).

Unvalidated example:

NoSQL injection test incomplete on /api/data - operators rejected with 400 Bad Request. Evidence: path/to/evidence.json

CWE Mapping

Primary CWE (DAST-testable):

• •CWE-943: Improper Neutralization of Special Elements in Data Query Logic
  • •This is THE designated CWE for NoSQL injection
  • •Alternate terms: "NoSQL Injection", "NoSQLi"
  • •Covers: MongoDB, Cassandra, CouchDB, Redis, Elasticsearch, DynamoDB, and other NoSQL databases

Parent/Related CWEs (context):

• •CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') — parent class
• •CWE-20: Improper Input Validation — related root cause
• •CWE-116: Improper Encoding or Escaping of Output — related mitigation failure

Sibling CWEs under CWE-943 (for reference):

• •CWE-89: SQL Injection (separate skill)
• •CWE-90: LDAP Injection
• •CWE-643: XPath Injection
• •CWE-652: XQuery Injection

Related Attack Pattern:

• •CAPEC-676: NoSQL Injection

Note: Unlike SQL injection (CWE-89), NoSQL injection does not have a dedicated base-level CWE. CWE-943 at the class level is the correct mapping for NoSQL injection vulnerabilities per MITRE guidance.

Notable CVEs (examples)

• •CVE-2024-50672 (eLearning Platform): NoSQL injection via Mongoose find function allowing password resets.
• •CVE-2021-20736 (Rocket.Chat): NoSQL injection in team collaboration product.
• •CVE-2021-22911 (Rocket.Chat): Blind NoSQL injection allowing admin account takeover.
• •CVE-2020-35666 (PaaS Platform): NoSQL injection using MongoDB operator.
• •CVE-2019-2389 (MongoDB): Information disclosure via aggregation pipeline.
• •CVE-2017-18381 (KeystoneJS): NoSQL injection in password reset functionality.

Safety Reminders

• •ONLY test against user-approved targets; stop if production protections trigger
• •Do not log or store sensitive data; redact in evidence
• •Prefer parameterized queries and input validation in mitigations
• •Disable server-side JavaScript execution in production MongoDB (--noscripting)

Reference Implementations

• •See reference/nosql_payloads.py for NoSQLi payloads by database type
• •See reference/validate_nosqli.py for NoSQLi-focused validation flow
• •See examples.md for concrete NoSQLi scenarios and evidence formats

Additional Resources

• •OWASP NoSQL Injection
• •PortSwigger NoSQL Injection
• •CAPEC-676: NoSQL Injection
• •HackTricks NoSQL Injection