Cybersecurity glossary
What is NoSQL Injection?
Learn what NoSQL injection is, how attacker-controlled operators manipulate MongoDB and other document queries, how it differs from SQL injection, and how to prevent it with safe query construction.
Definition
NoSQL injection is an attack technique that manipulates NoSQL database queries by injecting operators, crafted JSON structures, or unexpected types into application inputs, causing unauthorized data access, authentication bypass, or other unintended database behavior.
Why NoSQL injection matters
Moving from SQL to document databases does not remove injection risk. It changes the shape of the bug. Instead of quote characters breaking a SQL string, attackers may send JSON objects with operators such as $gt, $ne, or $where that rewrite query logic.
NoSQL injection has produced authentication bypasses, mass data extraction, and unexpected writes—especially in APIs that accept rich JSON bodies and pass them into database filters with too much trust.
How NoSQL injection works
Locate query-driven input
Login fields, search filters, and API query objects that become database predicates.
Change types and structure
Send objects/arrays where strings are expected, or nest operator keys.
Trigger operator semantics
The driver interprets attacker keys as query operators rather than literal values.
Observe unauthorized outcomes
Successful login, broader result sets, or altered update matches confirm injection.
Expand data access
Enumerate fields, dump collections, or bypass tenancy filters.
Automate across endpoints
Apply the same payload patterns to other filters and admin APIs.
Common vulnerable patterns
Client-supplied query objects
Passing req.body.filter directly into find() lets clients supply operators.
Loose typed logins
Password compared via operators instead of exact string equality.
Dynamic $where / scripted queries
JavaScript expressions built from input create code-injection-like risk.
Unvalidated operators in search UIs
Advanced filters expose operator maps without allowlisting.
NoSQL vs SQL injection
| Aspect | SQLi | NoSQLi |
|---|---|---|
| Typical payload shape | SQL syntax in strings | JSON operators / type confusion |
| Primary fix | Parameterized queries | Typed inputs + safe query APIs + allowlists |
| Common impact | Read/modify relational data | Bypass auth, dump documents, widen filters |
Prevention checklist
- Cast and validate that credentials and IDs are primitive strings/numbers before querying.
- Never merge raw user JSON into query objects; build queries server-side field by field.
- Allowlist accepted filter fields and operators for any advanced search feature.
- Disable or strictly control server-side JavaScript query features.
- Apply least privilege to database users used by the application.
- Add tests that attempt operator injection on login and search endpoints.
- Review ODM usage for helpers that accept untrusted query documents.
- Log authentication anomalies that may indicate bypass attempts.
The practical takeaway
NoSQL injection manipulates document/query logic with attacker-controlled structures and operators. Leaving SQL behind does not leave injection behind.
Treat every database filter as code: validate types, allowlist fields, and construct queries explicitly on the server. If clients can send $ operators into your find criteria, assume they will.
Related security terms
SQL Injection (SQLi)
The relational-database cousin that shares the unsafe-query-construction root cause.
Blind SQL Injection
Inference techniques that can also appear conceptually in NoSQL operator probing.
Broken Authentication
Login bypass via NoSQL operator injection is a common high-impact outcome.
SQL Injection
Related vulnerability deep dive for relational SQL injection patterns.
Frequently asked questions
What is NoSQL injection in simple terms?
NoSQL injection happens when user input changes a database query in dangerous ways—for example by sending JSON operators instead of a plain password string—so the database returns data or accepts a login it should not.
Is NoSQL injection the same as SQL injection?
The root idea is similar—untrusted input alters query logic—but the syntax and operators differ. NoSQL attacks often abuse JSON structures and database-specific operators rather than SQL strings.
Which databases are affected?
Document stores such as MongoDB are frequently discussed, but any NoSQL system can be abused if applications build queries unsafely from user input.
What does a classic MongoDB login bypass look like?
Instead of a password string, an attacker may send an object like {"$ne": null} so the query becomes 'password not equal to null' and matches unexpectedly when drivers accept nested operators.
How do you prevent NoSQL injection?
Validate types strictly, avoid mixing user objects directly into queries, use safe driver APIs, allowlist fields, and cast inputs to expected primitives (strings, numbers) before querying.
Can ORMs or ODMs stop NoSQL injection?
They help when used correctly, but raw queries, dynamic operators, and accepting client-supplied query objects can still create injection paths.
Does input encoding for HTML stop NoSQL injection?
No. HTML encoding addresses XSS. NoSQL injection requires safe query construction and type validation on the server.
References
Explore authoritative guidance and frameworks related to nosql injection.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.