Home / Knowledge hub / NoSQL injection
Knowledge hub
NoSQL injection
Input that changes the meaning of a query to a non-SQL database.
What it means
NoSQL injection is input that alters the meaning of a query sent to a database that does not use SQL, such as MongoDB, CouchDB or Redis. The query is written in a different language, but the weakness is the same: data is allowed to act like instructions.
With some databases the attack uses operators rather than quote marks. A JSON field expected to hold a password can arrive holding a small object that means "not equal to nothing" instead of text, and the comparison then matches any account, whatever the real password is.
Why it matters
The business harm resembles other injection flaws: sign-in bypass, reading data that belongs to others, changing records, and sometimes running code on the database server. Teams often assume that moving away from SQL removed injection risk. It did not, and the habit of trusting parsed request data travels with the team to the new database.
It matters more because the flaws are less familiar. Frameworks and training focus on SQL, so NoSQL queries are more often built from raw request data without anyone stopping to ask. Injection remains a top web risk in the OWASP Top 10.
How it shows up
You meet it where an API passes parsed JSON or form values straight into a query: sign-in, search filters, lookups by identifier. If the framework turns a nested query-string value into an object, an attacker supplies operators instead of plain text.
Defences: check the type and shape of every input before using it, so a string field is always a string; use the driver's safe query-building features; never build queries from concatenated strings or evaluate user text as code; and give the database account only the access it needs. Test by sending operators in place of values.
Questions people ask
NoSQL injection, answered
Is NoSQL injection the same as SQL injection?
The idea is the same, the syntax is different. SQL injection alters a SQL statement. NoSQL injection alters a query written in another language or in a data structure such as JSON.
Protections differ in detail, but both rely on keeping input as data.
Are NoSQL databases safer than SQL ones?
Not by default. They avoid SQL-specific problems but have their own. Safety depends on how your code builds queries and on how the database is configured.
Treat input the same way whichever database you use.
Does an object relational mapper prevent it?
Mapping libraries help when you use their safe query methods with typed values. They do not help if you pass raw request objects into the query.
Check what type of value actually reaches the library, and review every place that uses a raw query.
What does a typical attack look like?
A sign-in request sends an operator in place of the password, so the comparison is true for any account. Another example sends a condition that always matches, to return every record.
The payload is valid JSON, so it looks normal.
How do we test for it?
Replace expected strings with operator objects, arrays or unexpected types in sign-in and search requests, and watch whether the behaviour changes.
A different response, a bypass or a delay each signals a problem.
Related
Terms that sit next to this one
Injection
Input that ends up running as a command instead of being read as text.
SQL injection
Input a database ends up running as part of a query.
Input validation
Checking that what arrives is the shape and range you expected.
Parameterised queries
Sending the query and the data separately so input can never become code.
Object injection
Supplying crafted serialised data so your app builds objects the attacker designed.
What if the password is an object?
We test sign-in, search and lookups with unexpected input types and report only what we exploited, with the request and response. In white-box mode we point to the query in your code. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.