Node.js Applicative DoS Through MongoDB Injection
summary
Shows a practical exploit: sending a malicious query object that uses MongoDB $where with sleep to make the server execute a millisecond sleep per document, causing every connection in the app’s pool to block. Tests use ApacheBench to run parallel requests against a collection of ~10,000 documents; with the default pool size 5 all legitimate queries stall (measured requests taking minutes). Mongoose offers no automatic protection; recommended fixes are strict input schemas (Joi/celebrate) and rejecting unknown query operators.
AI-written summary · about
chapters (8)
- 0:00Introduction to injections
- 1:52SQL injection fundamentals
- 4:45MongoDB architecture
- 6:53NoSQL injection techniques
- 8:54Denial of service concepts
- 11:58Exploiting pool exhaustion
- 14:56Demonstrating a MongoDB DoS
- 19:57Prevention and mitigation
related talks
05mNoSQL injections in Node.js: The case of MongoDB
42mThe Node.js Highway: Attacks Are At Full Throttle
47mNode.js Security: Breaking The Loop
55mNode.js Security: Breaking The Loop
24mWriting Secure JavaScript
32mBuilding Next Generation Apps with Next.js and MongoDB
54mNoSQL Shouldn’t Mean NoSecurity
32mWriting Secure JavaScript Code