Security Test: NoSQL Injection Stored¶

Description¶

Default Severity: high

Stored NoSQL injection happens when an application saves untrusted user input directly into a database query without proper checking. This oversight lets attackers sneak harmful commands into the query, which can lead to unauthorized reading, altering, or even removal of data. Developers often pitfall by assuming inputs are safe without properly validating or sanitizing them. When malicious code is stored, it might be executed repeatedly, opening the door for continuous attacks that could compromise sensitive data and disrupt operations.

Reference:

• https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection

Configuration¶

Identifier: frontend_injection/nosql_stored

Examples¶

All configuration available:

checks:
  frontend_injection/nosql_stored:
    skip: false # default
    options:
      skip_objects: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶