1

I'm testing a web application and have found a parameter that is vulnerable to NoSQL injection (Elastisearch). The parameter is named username and is the only parameter in the HTTP Request. As a response, I just get a true/false message depending on if the username exists.

Based on error messages that I get if I insert a double quote in the username, I have concluded that the injection happens here:

[{"size":1000,"query":{"query_string":{"query":"username:INJECTION_POINT"","lowercase_expanded_terms":true}}}]]]

I can use this to extract values of fields that I do not have access to by performing boolean based NoSQL injection, for example by providing the following value: victims_username AND phone=0* (would result in a "true" message if the victims phone number starts with 0).

But is there anything else I could try? Is there any chance to enumerate field names? Is there any chance to perform RCE by using NoSQL injection in Elastisearch? Any other ideas?

The Elastisearch server is not directly exposed, but I suppose the application I am testing is performing the NoSQL queryes on an internal server.

  • 1
    I wonder if you could simply put the same parameters again and see how the parser on the other end reacts to that. It might be that your new keys would simply overwrite the previous ones, in that case you can easily break out of the query object and just make a new one with arbitrary settings. – André Borie Feb 28 '17 at 23:06
  • 2
    Also I can't believe people are still doing this stupid mistake. How dumb do you have to be to make this mistake (which involves building the JSON manually as a string) when every single programming language allows you to serialize a dictionary into JSON safely? – André Borie Feb 28 '17 at 23:06
  • Thanks for the tip! I have actually already tried to escape out of the query (by inserting a double quote and closing the curly brackets few times), and the parser accepts that, but I do not see what I could do with that as I assume I can only define a new query to the same endpoint as the original query. Or am I wrong? – stanko Feb 28 '17 at 23:12
  • Yes you could, and that is bad :O it is just as bad as when you can do a n arbitrary UNION SELECT within a SQL injection vuln. – marstato Feb 28 '17 at 23:17
  • Just a correction: I think I can escape out of the query string and define parameters inside the existing query object, but I cannot create a completely new query object. – stanko Feb 28 '17 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.