---
title: "NoSQL Injection - MongoDB"
description: "HawkScan test information for plugin 40033: NoSQL Injection - MongoDB"
url: https://docs.stackhawk.com/vulnerabilities/40033/
---

[Back to Index](https://docs.stackhawk.com/vulnerabilities/)

# NoSQL Injection - MongoDB

###### Reference

- **Plugin ID:** 40033
- [**CWE:** 943](https://cwe.mitre.org/data/definitions/943.html)
- **Risk:** High
- **Type:** Active
- **Category:**

### Remediation

1. **Input validation:** Always validate and sanitize user input before using it in a MongoDB query. This can help prevent malicious code injection.
2. **Parameterized queries:** Use parameterized queries or prepared statements to ensure that user input is treated as data and not executable code. This can help protect against injection attacks.
3. **Least privilege principle:** Ensure that the MongoDB user account used by the application has the minimum necessary privileges to perform its intended tasks. This can limit the potential impact of an injection attack.

### About

MongoDB query injection is a vulnerability that occurs when user-supplied input is not properly validated or sanitized before being used in a MongoDB query. This can allow an attacker to manipulate the query and potentially execute arbitrary code or access unauthorized data.

### Risks

1. **Data exposure:** An attacker may be able to retrieve sensitive data from the database by injecting malicious code into a MongoDB query.
2. **Data modification:** Injection attacks can also allow an attacker to modify or delete data in the database, potentially leading to data loss or unauthorized changes.
3. **Application compromise:** If an attacker is able to execute arbitrary code through a MongoDB injection, they may be able to gain control over the application and perform further malicious actions.