Java : NoSQL injection

An injection in an NoSQL query is possible. This can be exploited to bypass the authentication mechanism, access all database entries, or execute malicious code with application rights.

Client side code injection attacks take the first place in the “OWASP Top 10 2017” web application vulnerabilities ranking and the seventh place in the “OWASP Mobile Top 10 2014” ranking. The level of potential damage from such an attack depends on the user input validation performance and file protection mechanisms.

NoSQL injections occur when a database query is based on data from an untrusted source (e.g., from a string entered by a user). In the absence of proper validation an attacker can modify the query to execute malicious NoSQL query.

The most common variants of NoSQL injection:

• Direct addition of malicious code into a string variable, based on which the NoSQL query is generated.
• User’s data is used to dynamicaly construct a NoSql query.