the-web-application-hackers-handbook

Chapter 9 n Attacking Data Stores 343
NoSQL advocates claim this has several advantages, mainly in handling very
large data sets, where the data store’s hierarchical structure can be optimized
exactly as required to reduce the overhead in retrieving data sets. In these
instances a conventional database may require complex cross-referencing of
tables to retrieve information on behalf of an application.
From a web application security perspective, the key consideration is how
the application queries data, because this determines what forms of injection
are possible. In the case of SQL injection, the SQL language is broadly similar
across different database products. NoSQL, by contrast, is a name given to a
disparate range of data stores, all with their own behaviors. They don’t all use
a single query language.
Here are some of the common query methods used by NoSQL data stores:
n Key/value lookup
n XPath (described later in this chapter)
n Programming languages such as JavaScript
NoSQL is a relatively new technology that has evolved rapidly. It has not
been deployed on anything like the scale of more mature technologies such as
SQL. Hence, research into NoSQL-related vulnerabilities is still in its infancy.
Furthermore, due to the inherently simple means by which many NoSQL implementations
allow access to data, examples sometimes discussed of injecting into
NoSQL data stores can appear contrived.
It is almost certain that exploitable vulnerabilities will arise in how NoSQL
data stores are used in today’s and tomorrow’s web applications. One such
example, derived from a real-world application, is described in the next section.
Injecting into MongoDB
Many NoSQL databases make use of existing programming languages to provide
a flexible, programmable query mechanism. If queries are built using
string concatenation, an attacker can attempt to break out of the data context
and alter the query’s syntax. Consider the following example, which performs
a login based on user records in a MongoDB data store:
$m = new Mongo();
$db = $m->cmsdb;
$collection = $db->user;
$js = “function() {
return this.username == ‘$username’ & this.password == ‘$password’; }”;
$obj = $collection->findOne(array(‘$where’ => $js));
if (isset($obj[“uid”]))
{
$logged_in=1;