NoSQL Injection

What it is

NoSQL injection is a vulnerability where an attacker can inject or manipulate NoSQL queries to bypass authentication, extract data, or perform unauthorized operations. Unlike SQL injection, NoSQL injection often targets operator injection (MongoDB $ne, $gt, $regex), JSON body manipulation, or Redis command injection rather than string-based query manipulation.

Attack Vectors

Login forms passing credentials to MongoDB find()/findOne()
Search parameters parsed as JSON objects
API endpoints accepting JSON request bodies
Query string parameters that map to database operators
Cookie values used in database lookups

Testing Methodology

Test MongoDB operator injection: replace string values with {$ne: null}
Submit JSON with $gt, $lt, $regex operators in parameter values
Test for authentication bypass by injecting {$gt: ''} in password field
Try array injection in parameters expecting strings
Test Redis command injection in connection string parameters

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

MongoDB Auth Bypass

{"username": {"$ne": null}, "password": {"$ne": null}}{"username": "admin", "password": {"$gt": ""}}{"username": {"$regex": ".*"}, "password": {"$ne": "x"}}

MongoDB Operator Injection

[$ne]=1[$gt]=[$regex]=.*{"$where": "this.password.match(/.*/)"}

URL Parameter Injection

username[$ne]=invalid&password[$ne]=invalidsearch[$regex]=.*&search[$options]=iid[$gt]=0

Redis Injection

\r\nSET key value\r\n\nPING\n-1\nCONFIG SET dir /var/www/html\n

Indicators of Vulnerability

Authentication succeeds with injected operators instead of valid credentials
Query returns all documents when operators like $ne or $gt are injected
Application reflects or exposes raw MongoDB query errors
Unexpected data returned for manipulated query parameters

Detection Guidance

Validate that JSON inputs only contain expected scalar types, not objects. Monitor for MongoDB operator keys ($ne, $gt, $regex, $where) appearing in request parameters. Use schema validation on incoming data.

Mitigation & Remediation

Validate that query parameters are expected scalar types before use
Reject inputs containing MongoDB operator keys ($ne, $gt, $where, etc.)
Use a schema validation library to enforce input structure
Avoid constructing queries from raw user-supplied JSON objects
Apply field-level encryption for sensitive data in the database