flawopen.com/Reference/MongoDB NoSQL Injection
Yes. While MongoDB does not use SQL strings, it is vulnerable to Operator Injection. If an Express application parses JSON request bodies without type checking, an attacker can send an object like {"$ne": null} instead of a password string, logging in without knowing the password.
// Attacker sends: { "username": "admin", "password": { "$ne": null } } app.post('/login', async (req, res) => { const user = await db.collection('users').findOne({ username: req.body.username, password: req.body.password // Evaluates to: { $ne: null } -> TRUE! }); });
// Enforce string primitives strictly
app.post('/login', async (req, res) => {
if (typeof req.body.password !== 'string') {
return res.status(400).send("Invalid input");
}
const user = await db.collection('users').findOne({
username: String(req.body.username),
password: String(req.body.password)
});
});
express-mongo-sanitize middleware to strip keys beginning with $.