I'm testing a web application and have found a parameter that is vulnerable to NoSQL injection (Elastisearch). The parameter is named username and is the only parameter in the HTTP Request. As a response, I just get a true/false message depending on if the username exists.
Based on error messages that I get if I insert a double quote in the username, I have concluded that the injection happens here:
I can use this to extract values of fields that I do not have access to by performing boolean based NoSQL injection, for example by providing the following value: victims_username AND phone=0* (would result in a "true" message if the victims phone number starts with 0).
But is there anything else I could try? Is there any chance to enumerate field names? Is there any chance to perform RCE by using NoSQL injection in Elastisearch? Any other ideas?
The Elastisearch server is not directly exposed, but I suppose the application I am testing is performing the NoSQL queryes on an internal server.