NoSQL injection
Summary: PortSwigger Research describes NoSQL injection as a vulnerability where an attacker interferes with the queries an application sends to a NoSQL database, with two types covered and MongoDB, the most popular NoSQL database, used as the exploitation focus. The techniques shown include breaking query syntax with fuzz strings and special characters, injecting query operators such as $ne to bypass authentication, using MongoDB's $where operator and mapReduce() to run limited JavaScript, and extracting data character by character via $regex or timing-based payloads.
Why it matters: An operator as simple as $ne can return every login credential where username and password are not equal to invalid, logging the attacker in as the first user in the collection. Because NoSQL databases lack a universal query standard and have fewer relational constraints, the same input can behave differently across databases, so prevention depends on the specific technology in use.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026