Skip to main content

NoSQL injection

Need​

Prevention of NoSQL injection attacks

Context​

  • Usage of C# 7.1 for developing applications with advanced language features and improvements
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core MVC
  • Usage of MongoDB.Driver for interacting with MongoDB database in Node.js

Description​

Non compliant code​

public async Task<IActionResult> GetUser(string id)
{
    var filter = Builders<User>.Filter.Eq("Id", id);
    var user = await _context.Users.Find(filter).FirstOrDefaultAsync();

    return Ok(user);
}

This is a simple method in an ASP.NET Core controller that retrieves a user from a NoSQL database (MongoDB in this case) by their id. The GetUser method accepts a string parameter id from the client, which is used directly to construct a filter for the MongoDB query.

The vulnerability lies in the fact that the id parameter is not validated before it is used to construct the filter. This means that an attacker could potentially inject malicious code into the id parameter to manipulate the query, leading to a NoSQL injection attack. For instance, an attacker could provide a value for id that changes the logic of the query to return all users instead of just one, or worse, they could potentially delete records.

This vulnerability could lead to unauthorized access to data, data loss, and in some cases, full system compromise. It is therefore crucial to always validate and sanitize untrusted inputs before using them to construct database queries.

Steps​

  • Implement input validation to ensure that the 'id' parameter is a valid input.
  • Use parameterized queries or prepared statements to construct the NoSQL query.
  • Sanitize and validate the input before using it in the query to prevent any malicious input.
  • Implement proper access control to restrict unauthorized access to sensitive data.
  • Regularly update and patch the NoSQL database to ensure it is protected against known vulnerabilities.
  • Implement logging and monitoring to detect any suspicious activities or potential attacks.
  • Educate developers about NoSQL injection vulnerabilities and best practices for secure coding.

Compliant code​

public async Task<IActionResult> GetUser(string id)
{
    if (string.IsNullOrEmpty(id) || !Guid.TryParse(id, out var validId))
    {
        return BadRequest("Invalid user id");
    }

    var filter = Builders<User>.Filter.Eq("Id", validId);
    var user = await _context.Users.Find(filter).FirstOrDefaultAsync();

    return Ok(user);
}

The updated code now includes input validation to ensure that the 'id' parameter is a valid GUID. This is done using the Guid.TryParse method, which attempts to convert the string representation of a GUID to a Guid object. If the conversion is successful, it means that the 'id' parameter is a valid GUID. If the conversion fails, it means that the 'id' parameter is not a valid GUID and a bad request response is returned.

The string.IsNullOrEmpty method is used to check if the 'id' parameter is null or an empty string. If it is, a bad request response is returned.

The Builders&lt;User>.Filter.Eq("Id", validId) line constructs a parameterized query, which helps to prevent NoSQL injection attacks. The 'Id' field of the User document is compared with the 'validId' parameter. If they are equal, the User document is returned. If they are not equal, no User document is returned.

The await _context.Users.Find(filter).FirstOrDefaultAsync() line executes the query and returns the first User document that matches the filter, or a default value if no such document is found.

The return Ok(user) line returns an OK response with the User document. If no User document was found, the default value is returned.

This code helps to prevent NoSQL injection attacks by validating and sanitizing the 'id' parameter before using it in the query. It also uses a parameterized query to construct the NoSQL query, which helps to prevent NoSQL injection attacks.

References​

Last updated on