Nosql Injection in Feathersjs

Nosql Injection in Feathersjs occurs when user-supplied input is directly incorporated into MongoDB queries without proper sanitization. Unlike SQL injection, NoSQL injection exploits the query language's flexibility to manipulate database operations through crafted input.

In Feathersjs, the most common attack vectors appear in service methods that accept query parameters. Consider this vulnerable pattern:

const usersService = app.service('users');

// Vulnerable: Direct query parameter injection
app.get('/api/users', async (req, res) => {
  const query = { 
    $where: req.query.filter 
  };
  const users = await usersService.find({ query });
  res.json(users);
});

An attacker could send: /api/users?filter=this.constructor.constructor('return process.mainModule.require(%22os%22).homedir()')() to execute arbitrary code on the server.

Another common pattern involves $regex injection:

// Vulnerable: Regex injection
app.get('/api/search', async (req, res) => {
  const query = { 
    email: { $regex: req.query.pattern }
  };
  const results = await usersService.find({ query });
  res.json(results);
});

Feathersjs's service layer makes these attacks particularly dangerous because it automatically converts query parameters into MongoDB operators. An attacker can manipulate operators like $ne, $gt, $lt, or even inject $where clauses that execute JavaScript.

Object injection is another critical vulnerability:

// Vulnerable: Object injection via query params
app.get('/api/items', async (req, res) => {
  const query = JSON.parse(req.query.q);
  const items = await itemsService.find({ query });
  res.json(items);
});

If an attacker sends ?q={%22$ne%22:{%22%24where%22:%22return%20this.constructor.constructor('return%20process.env')()%22}}, they can potentially access environment variables.

Feathersjs's authentication hooks don't automatically protect against these injection patterns, making it crucial to validate and sanitize all user input before it reaches the database layer.

Detecting Nosql Injection in Feathersjs applications requires both static analysis and runtime scanning. middleBrick's black-box scanning approach is particularly effective for Feathersjs APIs because it tests the actual attack surface without requiring source code access.

middleBrick scans Feathersjs endpoints by submitting crafted payloads to test for NoSQL injection vulnerabilities. The scanner automatically tests for:

• $where clause injection with JavaScript execution
• $regex pattern injection
• Object injection via query parameters
• Operator manipulation ($ne, $gt, $lt, etc.)
• Array and object injection patterns

For a Feathersjs application running at https://api.example.com, you can scan it directly:

npm install -g middlebrick
middlebrick scan https://api.example.com/users

The CLI will test common injection patterns and report findings with severity levels. For CI/CD integration, add this to your GitHub workflow:

- name: Scan API Security
  uses: middlebrick/middlebrick-action@v1
  with:
    url: ${{ secrets.API_URL }}
    fail-on-severity: high
    token: ${{ secrets.MIDDLEBRICK_TOKEN }}

middleBrick's LLM/AI security checks are particularly relevant for Feathersjs applications using AI features. The scanner tests for system prompt leakage and prompt injection vulnerabilities that could be exploited alongside NoSQL injection.

Manual detection techniques for Feathersjs include:

// Test for $where injection
app.get('/test-injection', async (req, res) => {
  try {
    const query = { $where: req.query.test };
    const result = await usersService.find({ query });
    res.json({ success: true, count: result.length });
  } catch (error) {
    res.json({ error: error.message });
  }

Run this endpoint through middleBrick to verify it's properly protected. The scanner will attempt various injection payloads and report if any succeed.