Skip to main content

NoSQL injection

Need​

Prevention of NoSQL injection attacks

Context​

  • Usage of Python 3 for scripting and application development
  • Usage of Django for building web applications in Python
  • Usage of PyMongo for interacting with MongoDB in Python

Description​

Non compliant code​

from django.http import HttpResponse
from pymongo import MongoClient

def get_user(request):
    client = MongoClient('localhost', 27017)
    db = client['mydatabase']
    collection = db['users']

    # Get the user input
    user_input = request.GET.get('user')

    # This is a NoSQL injection vulnerability. User input is directly used in the query
    result = collection.find({"username": user_input})

    return HttpResponse(result)

In the get_user function, we are connecting to a MongoDB database, selecting the 'users' collection and then running a find query. The find query is supposed to return all documents in the 'users' collection that match the specified query filter.

The query filter here is {"username": user_input}, which is supposed to filter out all documents that have a 'username' field equal to user_input.

user_input is obtained directly from the user through the request.GET.get('user') line. This is where the NoSQL injection vulnerability lies.

The user input is directly used in a NoSQL query without any form of validation or sanitization. This means that a malicious user could potentially manipulate the query to retrieve data that they are not supposed to have access to, or even modify or delete data.

For example, a malicious user could input something like {"$gt": ""} which in MongoDB syntax means 'greater than nothing'. This would return all users in the database, regardless of their username. This is a serious data leakage vulnerability.

Even worse, if the application had some functionality that allowed for modification or deletion of data through similar queries, a malicious user could potentially input something like {"$set": {"role": "admin"}}, which would set the role of all users in the database to 'admin'. This is a serious data integrity and authorization vulnerability.

Steps​

  • Validate and sanitize the user input before using it in the query. This can be done using a library or framework that provides this functionality.
  • Use parameterized queries or prepared statements to ensure that user input is properly escaped before it is included in the query.
  • Implement a whitelist of valid input. This can be done by checking the user input against a list of valid options before including it in the query.
  • Limit the privileges of the database account used by the application. This can help to mitigate the impact of an injection attack.
  • Implement error handling that does not reveal sensitive information about the database or the query structure.

Compliant code​

from django.http import HttpResponse
from pymongo import MongoClient
from bson import ObjectId

def get_user(request):
    client = MongoClient('localhost', 27017)
    db = client['mydatabase']
    collection = db['users']

    # Get the user input
    user_input = request.GET.get('user')

    # Validate and sanitize the user input
    if not user_input:
        return HttpResponse("Invalid input")

    # Use parameterized queries to prevent NoSQL injection
    try:
        result = collection.find({"username": ObjectId(user_input)})
    except Exception as e:
        return HttpResponse("An error occurred")

    return HttpResponse(result)

The updated code includes several measures to prevent NoSQL injection attacks:

  1. Input Validation: The code checks if the user input is not empty. If the input is empty, it returns an "Invalid input" message. This is a basic form of input validation.

  2. Parameterized Queries: The code uses parameterized queries to prevent NoSQL injection. The ObjectId function from the bson library is used to ensure that the user input is properly escaped before it is included in the query. This function will throw an exception if the input is not a valid ObjectId, which helps to prevent injection attacks.

  3. Error Handling: The code includes a try/except block to handle any exceptions that occur when the query is executed. If an exception is thrown, the code returns an "An error occurred" message. This prevents sensitive information about the database or the query structure from being revealed.

  4. Database Account Privileges: Although not shown in the code, it is recommended to limit the privileges of the database account used by the application. This can help to mitigate the impact of an injection attack.

  5. Input Whitelisting: Although not shown in the code, it is recommended to implement a whitelist of valid input. This can be done by checking the user input against a list of valid options before including it in the query.

References​

Last updated on