MongoDB NoSQL Injection Analysis and Detection

Abstract

A NoSQL, also called a "Non-Relational" or "Not only SQL," database system provides an approach to data management and database design for very large sets of distributed data and real-time web applications. A NoSQL database system is also a popular data storage for information retrieval because it supports better scalability, availability, and faster data access while comparing with traditional relational database management systems (RDBMS). What the RDBMS data needs is predictable as its data is stored in structured tables by defining the relationship between the different columns. In contrary the data in NoSQL databases does not need to be stored in a structured or fixed fashion. When performance and real-time access are more concerned than consistency, such as indexing and retrieving large numbers of records, NoSQL databases are more suitable than relational databases. With their obvious advantages in better performance, scalability, and flexibility, NoSQL databases have been adopted lately by many small businesses as they are moving their increasing business data into the clouds. However, the research on the security of a specific NoSQL database system or NoSQL database systems in general is very limited. Although there are many storage advantages in NoSQL databases, the need of quick and easy access to data has been seriously affected by the security issue of NoSQL databases. This paper examines the maturity of security measures for MongoDB, a typical NoSQL database system, with aspects in both attack and defense at the code level. The experimental testing on NoSQL injections is performed with JavaScript and PHP. After the demonstration on how a server-side JavaScript injection attack against a NoSQL database system reveals the customer's private data, two methods are discussed in preventing this type of security problems from happening. It is believed that our study will help database developers not only realizing that NoSQL database systems are not designed with security as a priority but also learning how to build a security layer to their organizations' NoSQL applications to avoid NoSQL injections.