Back to scan results
What this check probes
The discovery stage inspects same-origin GET forms and links for parameters such as query, filter, search, selector, criteria, id, key, username, and collection. A bounded root-page fallback covers common names when no suitable public form is advertised.
Each selected input receives unmatched object delimiters, truncated JSON objects and arrays, an incomplete Unicode escape, and an incomplete bracketed value. Responses are compared with a harmless baseline for MongoDB/BSON, Mongoose, CouchDB/Couchbase, Redis, Cassandra, DynamoDB, and Elasticsearch errors.
A new database-specific exception or a new HTTP 5xx response produces a warning. Generic JSON parsing errors, ordinary HTTP 200 responses, reflection, redirects, response length, and validation messages are not treated as proof of NoSQL injection.
The check never sends query operators, wildcards, regular expressions, JavaScript predicates, bracket-operator parameter names, authentication-bypass objects, Redis commands, login POSTs, enumeration, writes, or data-extraction payloads. JSON bodies, authenticated APIs, GraphQL, mobile APIs, and unlinked endpoints remain outside this scan.
Why this matters for PCI DSS
NoSQL injection can change filters, selectors, expressions, or commands, potentially bypassing authentication, exposing records, altering stored data, or consuming excessive database resources.
PCI DSS secure-development requirements expect applications to prevent injection, validate and type untrusted input, authorize every object access, and limit database privileges. A pass here covers only the public GET surface tested with non-broadening values.
How to fix it
Accept scalar, typed values and build the query structure on the server. With the MongoDB .NET driver, validate identifiers and use typed filter builders instead of accepting raw JSON:
ObjectId customerId;
if (!ObjectId.TryParse(id, out customerId))
throw new HttpException(400, "Invalid customer id.");
FilterDefinition<Customer> filter =
Builders<Customer>.Filter.Eq(x => x.Id, customerId);
Customer customer = collection
.Find(filter)
.Limit(1)
.FirstOrDefault();
Reject objects and arrays where the contract expects a string, number, Boolean, date, or identifier. Never pass client JSON directly into a BSON document, selector, aggregation pipeline, filter expression, Redis command, or JavaScript-capable query feature.
If clients may choose sorting or filtering, map a short allowlist of public field names and operations to server-owned typed builders. Do not accept database field paths, operator names, collection names, projections, regular expressions, scripts, or raw expressions from the request.
Use parameter binding for CQL and N1QL, expression-attribute names and values for DynamoDB, fixed Redis commands with separate arguments, and structured Elasticsearch query builders. Disable server-side JavaScript features unless essential.
Apply schema validation, object-level authorization, result limits, query timeouts, and least-privilege database credentials. Return generic errors without connection strings, collection names, query documents, stack traces, driver types, or database topology.