I've been playing around with Nosql and specifically MongoDB injection on a few challenges and my lab. If you have an injection point you can easily enumerate and dump the database. But can you go beyond that, like the many things you can do with a SQL injection?

More specifically, is there any way to read or write files on the server from a MongoDB injection?

My Google search for that returned empty-handed so I looked at the mongo Database Commands but I didn't see anything obvious there that could be leveraged to read/write to arbitrary files.

  • 2
    What version of MongoDB are you using? This is important because in version 3.0, the javascript interpreter got better sandboxing (especially for MapReduce), but 2.x versions are still widely deployed.
    – Philipp
    Oct 15 '15 at 10:57
  • @Philipp Well I'm mostly just trying to expand my knowledge in this area so it would be worth knowing about both cases, especially if 2.x is still widely deployed.
    – Juicy
    Oct 15 '15 at 14:06
  • I know this was posted a while ago, but for anyone seeking an answer... FWIW, I totally agree with @Philipp. Although MongoDB by itself may not be as prone to injection, it is still worth being concerned about injection based on your software stack. Here is one example. It is important to consider what software stacks (language, frameworks, drivers, etc) you may see MongoDB used with and learn different pitfalls.
    – iraleigh
    Jul 17 '20 at 22:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.