Security Test: NoSQL Injection via Frontend¶

Description¶

Default Severity: high

NoSQL injection is when attackers insert malicious code into user inputs to manipulate a database query in ways you didn't intend. If the application builds queries by directly using unsanitized input, an attacker can trick it into showing or changing sensitive data, causing disruption or full control over the database. Developers often mistakenly trust that NoSQL queries are safe just because they aren't SQL, so not properly validating or filtering input can lead to big security risks.

Reference:

• https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection

Configuration¶

Identifier: frontend_injection/nosql

Examples¶

All configuration available:

checks:
  frontend_injection/nosql:
    skip: false # default

Compliance and Standards¶