NoSQL injection via user-controlled query input
ID |
vbnet.inject.nosql_injection |
Severity |
critical |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Inject |
Language |
VB.NET |
Description
User-controlled input flows into a NoSQL query without neutralization (a parsed BSON/JSON filter, a $where JavaScript expression, or a string filter passed to a MongoDB collection operation). An attacker can inject query operators to bypass filters, read other documents, or run arbitrary JavaScript on the server (NoSQL injection). Build queries with the typed Builders<T>.Filter API and pass user values as parameters; never concatenate untrusted input into a filter string or a $where clause.
Rationale
User-controlled input flows into a NoSQL query without neutralization (a parsed BSON/JSON filter, a $where JavaScript expression, or a string filter passed to a MongoDB collection operation). An attacker can inject query operators to bypass filters, read other documents, or run arbitrary JavaScript on the server (NoSQL injection). Build queries with the typed Builders<T>.Filter API and pass user values as parameters; never concatenate untrusted input into a filter string or a $where clause.
The following code illustrates a vulnerable pattern detected by this rule:
Public Sub FindFromRequest(ByVal Request As HttpRequest, ByVal collection As IMongoCollection(Of BsonDocument))
Dim query As String = Request.QueryString("q")
' VULNERABLE: NoSQL injection via user-controlled query input
Dim result = collection.Find(query)
End SubRemediation
Follow secure coding practices and review the references below for detailed remediation guidance.