NoSQL Injection in findOne() function

Description

Untrusted user input in the findOne() function can result in NoSQL Injection, allowing attackers to manipulate the database query and potentially extract or modify sensitive data.

Examples

Insecure Code

const username = req.body.username; db.collection.findOne({ username: username })

Secure Code

const sanitize = require('mongo-sanitize'); const username = sanitize(req.body.username); db.collection.findOne({ username: username })

Remediation

Use a sanitization library like 'mongo-sanitize' to neutralize special elements in user input before passing it to the findOne() function.

Rule Details

Field	Value
ID	CODE-0359
Category	Injection
Severity	CRITICAL
CWE	CWE-943
Confidence	HIGH
Impact	HIGH
Likelihood	HIGH
Exploitability	EASY
Tags	NoSQL Injection, User Input Validation
OWASP	A1:2017-Injection, A03:2021-Injection

---