NoSQL injections in Node.js: The case of MongoDB
summary
Demonstrates that Node.js Express apps can accept MongoDB $ne payload to enumerate every document, and that legacy $where remote exec allowed calling db.dropDatabase on MongoDB 2.3 and older so an injection could destroy data. Reproduces the exploit against a simple search endpoint, shows the number of documents returned unexpectedly grows to the entire collection, and prescribes input validation using joy and celbrate middleware or a bespoke validator to block nonstring inputs.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 0:32MongoDB endpoint
- 0:51Expected behavior
- 1:24MongoDB literal
- 2:09Drop MongoDB
- 3:16Conclusion
