hunting-nosql-operator-and-where-injection

name	hunting-nosql-operator-and-where-injection
description	Hunt NoSQL injection where untrusted input becomes query structure rather than a bound value: a request body whose keys turn into query operators, a value that arrives as an object instead of a scalar, or input reaching a server-side JavaScript evaluation such as $where, a mapReduce function, or an aggregation expression. Covers document stores where a filter built from a request object lets the caller inject comparison operators, always-true conditions, or code, and key-value or wide-column stores where input shapes the query language. Use when data access takes structured input from the request into a query filter or a server-side expression. The untrusted value that becomes an operator or an expression is the source, the query or evaluation call is the sink, and the missing type and shape check is the bug.
license	MIT

Hunting NoSQL operator and where injection: when a value arrives as an operator

NoSQL injection rarely looks like classic SQL injection because there is no string to concatenate. Instead, a document store filter is often built directly from a request object, so if the attacker sends an object where the code expected a scalar, its keys become query operators. A login check that compares a password to a request field can be turned always-true by sending an operator that matches anything. Worse, some stores evaluate server-side JavaScript, in a $where clause, a mapReduce function, or an aggregation expression, and untrusted input reaching that path is code execution inside the database. You find these by separating filters that bind scalar values from those that accept a request-shaped object or an expression, and tracing untrusted input into the latter.

When to use

• Data access uses a document, key-value, or wide-column store with request-built query filters.
• A request field expected to be a scalar could arrive as an object whose keys become operators.