Security Test: NoSQL Injection Stored¶

Description¶

Default Severity: high

Stored NoSQL injection happens when user input isn’t properly checked and ends up being saved into a database query, essentially letting attackers embed harmful NoSQL commands into parts of your application. This can let them not just read data they shouldn’t have access to but also modify or wipe out important data, potentially even interfering with system operations. Developers often make this mistake by trusting input too much, forgetting to thoroughly sanitize or validate it before using it in database queries. The risk is that once the malicious code is stored, it can be repeatedly used to compromise the system, which is why proper input handling and secure query methods are so important.

Reference:

• https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection

Configuration¶

Identifier: injection/nosql_stored

Examples¶

All configuration available:

checks:
  injection/nosql_stored:
    skip: false # default
    options:
      skip_objects: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶