I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What other type of attacks can be leveraged against MongoDB?
There are injection attacks against MongoDB, but these are largely mitigated by using proper data adapter libraries. Nonetheless, it's worth knowing that it's possible to inject in a few ways.
The first thing you've got to look out for is cases where you dynamically build a
It may also be possible to escape the
All in all, I'd avoid stuff like NodeJS for anything security-critical. It's not been designed with any form of security in mind, and it's a young project. If you're consuming MongoDB from a different language, that's fine.
For more details, see MongoDB's FAQ.
Also MongoDB should not be assessable to the public. It can be password protected, and passwords can be brute-forced. Client-Side js can communicate with MongoDB directly, and MongoDB can authenticate individual users. However their authentication system is overly simplistic, and in practice I have only seen this design fail.