thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

NoSQL Injection

Injection against NoSQL databases such as MongoDB, where crafted input alters query operators or logic.

Definition

Attackers may inject query operators (for example JSON objects instead of strings) or JavaScript in server-side evaluation features. Mitigations include strict type checking, schema validation, avoiding server-side JavaScript evaluation and using driver query builders with sanitized input.

Example

A login API accepts a password value that is an object containing a comparison operator rather than a string, bypassing authentication.

Exam tip

NoSQL does not mean no injection; enforce input types.

Related terms