How do you prevent 'Injection' attacks in a NoSQL environment like MongoDB?

Question

Accepted Answer

NoSQL injection attacks exploit the fact that user input can alter the structure of a database query, leading to unauthorized data access, authentication bypass, or data corruption. In MongoDB, injection vectors include maliciously crafted query objects that can bypass authentication (e.g., sending `{"$ne": null}` as a password field) or operators like `$where` that execute arbitrary JavaScript. The primary defense is to never construct queries by concatenating user input into query strings and to rely on the driver's safe query building capabilities. // ❌ VULNERABLE: String concatenation with user input
const username = req.body.username;
const password = req.body.password;

// If attacker sends username = "admin" and password = '{"$ne": null}'
// The query becomes: { username: "admin", password: { "$ne": null } }
// This returns the admin user WITHOUT a valid password!
const query = `{ username: "${username}", password: "${password}" }`;
const user = db.collection('users').findOne(JSON.parse(query));

// ❌ VULNERABLE: Using user input directly in $where
const query = { $where: `this.username == '${username}'` };
// Attacker could inject: '; return true; //' to bypass condition // ✅ SAFE: Use driver's query object directly
const username = req.body.username;
const password = req.body.password;

const user = await db.collection('users').findOne({
  username: username,  // Driver safely escapes
  password: password   // Treats as literal value, not operator
});

// ✅ SAFE: For dynamic operators, use whitelist approach
const allowedOperators = ['$eq', '$gt', '$lt', '$gte', '$lte'];
const filter = {};
if (req.query.sortBy && allowedOperators.includes(req.query.sortOp)) {
  filter[req.query.sortBy] = { [req.query.sortOp]: Number(req.query.value) };
} else {
  filter[req.query.sortBy] = req.query.value;
} **Use Driver Query Objects**: Always construct queries using the driver's native object syntax. MongoDB drivers automatically handle escaping and treat user input as literal values unless explicitly using operators. **Validate and Sanitize Input**: Use libraries like Joi, Zod, or express-validator to validate input types, lengths, and patterns before using them in queries. **Whitelist Operator Allowlist**: If users can specify operators (e.g., sorting, filtering), create a strict whitelist of allowed operators and field names. **Avoid $where and $function**: These operators execute JavaScript, which is a primary injection vector. If required, use them with extreme caution and only with sanitized, whitelisted input. **Use Mongoose Schema Validation**: Mongoose provides schema-level validation that can reject malformed input before it reaches the database. **Least Privilege Database Users**: Create database users with only the necessary permissions. Avoid using admin accounts for application connections. **Authentication Bypass**: Sending `{"$ne": null}` or `{"$gt": ""}` in password field to return any user without password validation. **Operator Injection**: Injecting MongoDB operators (`$gt`, `$in`, `$regex`) into queries to alter logic. **$where Injection**: Injecting JavaScript into `$where` clauses to return unintended documents. **Schema Poisoning**: Sending unexpected fields that bypass schema validation and corrupt data. import { z } from 'zod';

// Define validation schema
const userQuerySchema = z.object({
  username: z.string().min(3).max(50),
  age: z.number().int().min(0).max(150).optional(),
  status: z.enum(['active', 'inactive', 'pending']).optional()
});

// In your route handler
const result = userQuerySchema.safeParse(req.query);
if (!result.success) {
  return res.status(400).json({ error: 'Invalid input', details: result.error });
}

const { username, age, status } = result.data;
const users = await db.collection('users').find({ username, age, status }).toArray(); For Mongoose users, the library provides built-in protections. Mongoose sanitizes queries by default, preventing operator injection on top-level fields . However, `$where` and `$function` remain vulnerable and should be avoided. Always use Mongoose's schema validation with `required`, `min`, `max`, `enum`, and custom validators to ensure data integrity before it reaches the database. The combination of schema validation, query sanitization, and strict input validation layers creates a robust defense against NoSQL injection attacks.

How do you prevent 'Injection' attacks in a NoSQL environment like MongoDB?

Prevent NoSQL injection in MongoDB by using parameterized queries with the official driver, validating and sanitizing all user input, and strictly limiting the use of raw JavaScript execution.

Scenario Questions

Follow-up Questions