NoSQL operator injection
// tool: test_nosql_injectionWhen a query is built straight from a client-controlled value — db.find({code: input}) — a JSON body can smuggle an operator object in place of the expected string. The object matches stored documents instead of an exact value, turning a lookup into an always-match: free coupons, auth bypass, data exfiltration. NewScan swaps a field's literal for each of these and flags only when it flips a failing lookup into a success, or when the database itself leaks an error.
// ALWAYS-MATCH OPERATOR OBJECTS
// INJECTION LOCATIONS TESTED
Point it at any login, lookup, coupon, or search field. Pass base_body with the other valid fields so only the injected one changes.
// WHY THIS STAYS FALSE-POSITIVE-FREE
A random benign literal is sent first — it must fail the lookup, exactly as it would on a safe server. Only two things get recorded: a payload that flips that failure into success (a different, 2xx response), or a payload that leaks a database engine error proving it reached the query parser. Both are re-confirmed once before the finding is written, so a flaky signal is dropped. A server that treats the operator as an opaque string still fails — and is never flagged.
ENGINE-ERROR TOKENS THAT CONFIRM A HIT
Adjacent injection classes
// same differential engineWhen the datastore layer is ambiguous, the same fail-then-flip discipline covers the neighbours a NoSQL app often mixes in:
| Class | Tool | Payloads |
|---|---|---|
| XPath injection | test_xpath_injection | ' or '1'='1 ' or 1=1 or ''=' x' or name()='x ']|//*|//[' |
| LDAP injection | test_ldap_injection | * *)(uid=*))(|(uid=* admin)(&) *))%00 *)(|(objectclass=*)) |
| Type juggling | test_type_juggling | true 0 [] (typeless auth-field bypass) |
MongoDB misconfigurations
// exposure & leaked credentials| Misconfiguration | How NewScan finds it | Severity |
|---|---|---|
| Exposed MongoDB (27017) | Network scan maps the open port and flags it: ensure auth is on and it isn't internet-reachable. | exposure |
| Vulnerable server version (MongoBleed) | On an exposed instance the network scan fingerprints the server version over the wire (unauthenticated buildInfo) and cross-references it against the offline known-CVE dataset — a version in range for CVE-2025-14847 ("MongoBleed") is flagged, not just the open port. FP-safe: only fires on a version it actually read. | high |
| Connection string leaked | mongodb:// / mongodb+srv:// URIs disclosed in a client response or config dump. | high |
| Credentials in the URI | A connection string carrying an inline user:pass@ — a directly usable credential. | high |
| Atlas verification token | DNS recon surfaces the mongodb-site-verification= TXT record (Atlas footprint disclosure). | info |
| MongoError disclosed | A verbose MongoError in a response — leaks stack/query detail and confirms the backend. | info |
Application-level flaws
// Mongoose / ODM aware// PRIVILEGE ESCALATION VIA A MONGOOSE ENUM ROLE
Client-controlled role (mass assignment / BOPLA)
Many Mongoose schemas constrain role with enum: [CUSTOMER, …, ADMIN], which rejects a generic boolean sentinel and hides the flaw from naive scanners. NewScan instead submits the real privileged values — ADMIN, admin, administrator, superadmin, root — and confirms only if the object reads back carrying the exact value it sent. A server that forces a default role returns something else and is never flagged, so this stays false-positive-free while catching a genuine self-serve privilege escalation.
Recent MongoDB security issues
// why these checks matterA sample of the classes above, seen in the wild — an ODM-level NoSQL injection in Mongoose, a memory-leak flaw on exposed instances, and the operator-injection technique the differential engine is built to catch.
CVE-2025-23061
Breaking Mongoose with a nested $where
A NoSQL injection through populate().match in Mongoose before 8.9.5 / 7.8.4 / 6.13.6 — the exact ODM layer this page's app checks ride on.
VSec →
CVE-2025-14847 · CVSS 8.7
"MongoBleed" memory-leak flaw
An unauthenticated zlib-compression flaw leaks heap memory — passwords, API keys — from internet-exposed MongoDB servers. NewScan fingerprints the server version and flags an in-range install for this CVE, on top of the exposure itself.
The Hacker News →
Technique · 2025
NoSQL injection: MongoDB & CouchDB guide
A walkthrough of operator- and code-injection against document stores — the $ne/$gt/$regex always-match payloads the differential engine reproduces.
denizhalil.com →
External links; referenced for context. CVE severities and details are the publishers'.
How it's recorded
// audit-ready evidenceCATEGORY
NoSQL injection findings map to OWASP API8: Injection (NoSQL), tagged for MongoDB / CouchDB.
SEVERITY
One calibrated severity that translates into each framework's risk rating and remediation SLA — no inflated numbers.
EVIDENCE
Every finding is verified: the exact request, the payload, and the baseline-vs-hit differential are stored.
Point it at your API.
NewScan is free and self-hosted — bring your own key. The NoSQL, injection, and misconfiguration checks above run in the deterministic floor with no model or provider key at all.