Injection Flaws in Dynamodb

Injection flaws in DynamoDB occur when untrusted input is incorporated into DynamoDB operations without proper validation or parameterization. Unlike SQL injection, DynamoDB injection exploits the NoSQL query structure and expression syntax to manipulate query logic, bypass authorization, or extract unauthorized data.

The most common DynamoDB injection vectors include:

• Expression attribute injection - Manipulating FilterExpression, KeyConditionExpression, or UpdateExpression parameters
• Parameter injection - Injecting malicious values into condition parameters
• Document injection - Crafting JSON documents that alter query behavior
• Projection expression injection - Manipulating which attributes are returned

Consider this vulnerable DynamoDB query:

const userId = req.query.userId; // User-controlled input
const params = {
  TableName: 'Users',
  KeyConditionExpression: 'userId = :userId',
  ExpressionAttributeValues: {
    ':userId': userId
  }
};
const result = await dynamodb.query(params).promise();

If an attacker supplies userId =