NoSQL Injection

NoSQL injection targets databases such as MongoDB, CouchDB, DynamoDB or Redis that expose query languages built from JSON documents, BSON, or embedded JavaScript. Instead of breaking out of strings, an attacker manipulates structure — for example sending a JSON body with operators like {"$ne": null} or {"$where": "..."} to bypass authentication, dump documents, or execute server-side JavaScript. Object deserialization in dynamic languages (PHP, Node.js) often makes the attack trivial because user input becomes part of the query DSL. Defences include strict input typing and schema validation, denying user-supplied operators, parameterized client APIs, disabling server-side JavaScript, and least-privilege database roles.