Mongodb Avoiding Injection Attacks Complete Guide

Understanding Injection Attacks

An injection attack occurs when an attacker is able to manipulate input data to the database in a way that alters the meaning of or executes unintended commands. This can be particularly dangerous if you are dynamically constructing MongoDB queries using unsafe user input.

Safe Practices to Avoid MongoDB Injection Attacks

1. Use Parameterized Queries
2. Input Validation
3. Sanitize User Inputs

Let's go through these practices with examples. We'll use Node.js and MongoDB's official driver (mongodb) for simplicity.

Step-by-Step Guide

1. Using Parameterized Queries

Parameterized queries ensure that user inputs are treated strictly as data and never as part of the command.

Example:

const { MongoClient } = require('mongodb');

// Connection URL
const url = 'mongodb://localhost:27017';
const client = new MongoClient(url);

// Database Name
const dbName = 'mydatabase';

async function main() {
    // Use connect method to connect to the server
    await client.connect();
    console.log('Connected successfully to server');
    
    const db = client.db(dbName);
    const collection = db.collection('users');

    // Unsafe query (do not use)
    // const username = "test' OR '1'='1"; 
    // const resultsUnsafe = await collection.find({ username }).toArray();

    // Safe query
    const username = "test' OR '1'='1";
    const resultsSafe = await collection.find({ username }).toArray();
    console.log(resultsSafe);

    // Close connection
    await client.close();
}

main().catch(console.error);

Even though above example seems correct, you must use parameters with mongodb driver for other operations like aggregation pipeline which can be vulnerable.

const { MongoClient } = require('mongodb');

const url = 'mongodb://localhost:27017';
const client = new MongoClient(url);

const dbName = 'mydatabase';

async function main() {
    await client.connect();
    console.log('Connected successfully to server');
    
    const db = client.db(dbName);
    const collection = db.collection('users');

    const username = "maliciousUser";

    // Safe Aggregation Pipeline example
    const query = [
        {
            $match: { username }
        },
        {
            $lookup:
                {
                    from: "orders",
                    localField: "_id",
                    foreignField: "userId",
                    as: "order_docs"
                }
        },
        {
            $project: {
                username: 1,
                "order_docs.item": 1
            }
        }
    ];

    const resultsSafe = await collection.aggregate(query).toArray();
    console.log(resultsSafe);

    await client.close();
}

main().catch(console.error);

Explanation: Here, the username variable is safely used in the MongoDB query. Even if it contains malicious strings like "test' OR '1'='1" (which would evaluate to true in SQL), the MongoDB driver treats it as a string literal in the query.

2. Input Validation

Validate all user inputs before they are processed further. Use libraries like express-validator or joi for validation.

Example:

Using joi for validation:

const { MongoClient } = require('mongodb');
const Joi = require('joi');

const url = 'mongodb://localhost:27017';
const client = new MongoClient(url);

const dbName = 'mydatabase';

async function main(username) {
    try {
        // Define schema and validate input
        const schema = Joi.string().alphanum().min(3).max(30).required();
        await schema.validateAsync(username);
    } catch (err) {
        console.error("Invalid input:", err.message);
        return;
    }

    await client.connect();
    console.log('Connected successfully to server');
    
    const db = client.db(dbName);
    const collection = db.collection('users');

    // Safe query after validating input
    const resultsSafe = await collection.find({ username }).toArray();
    console.log(resultsSafe);

    await client.close();
}

// Main function call with safe input
main('abc123').catch(console.error);
// Main function call with malicious input
main("test' OR '1'='1").catch(console.error);

Explanation: We use joi to define a validation schema that ensures the username only includes alphanumeric characters within a certain length range. If the input does not meet these criteria, the code will log the error and not execute the query.

3. Sanitizing User Inputs

Sanitizing inputs means cleaning or escaping special characters from user input that could potentially affect the structure and execution of your queries.

Example:

A simple example of string sanitization:

const { MongoClient } = require('mongodb');
const sanitizeHtml = require('sanitize-html'); // Install via npm install sanitize-html

const url = 'mongodb://localhost:27017';
const client = new MongoClient(url);

const dbName = 'mydatabase';

async function sanitizeAndQuery(input) {
    const username = sanitizeHtml(input, {
        allowedTags: [],
        allowedAttributes: {}
    });

    await client.connect();
    console.log('Connected successfully to server');
    
    const db = client.db(dbName);
    const collection = db.collection('users');

    const resultsSafe = await collection.find({ username }).toArray();
    console.log(resultsSafe);

    await client.close();
}

// Main function call with safe input
sanitizeAndQuery('abc123').catch(console.error);
// Main function call with malicious input
sanitizeAndQuery("test' OR '1'='1").catch(console.error);

Explanation: We use the sanitize-html package to escape any special characters from user inputs ensuring that they only pass plain text to the MongoDB query.

Summary

To avoid injection attacks in MongoDB, follow these best practices:

1. Always use parameterized queries: This ensures that user inputs are handled as data and do not alter the query structure.
2. Validate user inputs: Verify that the input meets predefined criteria; use packages like express-validator or joi.
3. Sanitize user inputs: Remove or escape special characters using packages like sanitize-html.