[Security] NOSQL-injection

As you might imagine from the name, having no SQL, means having no SQL injection. But does that make them completely secure for use, or can similar injection attacks be performed against applications using these kinds of databases?

MongoDB

I'll use MongoDB as the target of this blog post. MongoDB is a document-storage database, storing the documents as JSON BSON. MongoDB features a rich set of possibilites for querying the database. The query language is also JSON BSON, but also supports expressing it as JSON(updated 2010-07-06). As you can imagine this could open for JSON-injection.

Consider this query:db.foo.find( { $or : [ { a : 1 } , { b : 2 } ] } )If the number 2 in the query above was coming from concatenation of string input, we might get the following injection:db.foo.find( { $or : [ { a : 1 } , { b : 2 }, { c : /.*/ } ] } )

MongoDB also allows you to query by javascript expressions like this:db.myCollection.find( { $where: "this.a > 3" } );Again I can imagine bad things happening, if parts of what's in the javascript expression, comes from input.

There are good news though. This query interface really seems to encourage building language supported, fluent APIs. The .NET implementation called mongodb-net, has a syntax like this: coll.FindOne(Where.Field(a => a == 1)); As we can see the query language is mirrored in C#, and if implemented properly, this encourages the developers using the API to use a syntax where you don't have to think about mixed contexts (control characters etc.). Given that the database driver is correctly implemented, this should help developers implement this in a secure way. Another implementation called mongodb-sharp supports Linq, which in many ways does the same thing.

Other types of NoSQL databases

There are loads of other NOSQL databases, like Couchdb, Cassandra and Neo4j. I'll probably have a look at some more of these in future blog posts, but in general I guess you could say that if there is a query language, it's usually possible to perform an injection attack (QL-injection - Query Language injection) in one way or another.

Just in case someone gets the wrong idea, these security flaws would be flaws in the application generating the query - not in the NOSQL database engine. Same thing holds for regular SQL injection.

Update 2011-03-09

NoSQL-injection in php when using MongoDB