NoSQL Injection: Cosmos DB

Constructing a dynamic Azure Cosmos DB query with input that comes from an untrusted source could allow an attacker to modify the query's action.

NoSQL injection in Cosmos DB occurs when:

1. Data enters a program from an untrusted source.



2. The data is used to dynamically construct a Cosmos DB query.

Example 1: The following code dynamically constructs and executes a Cosmos DB query that searches for an email with a specific ID.

...
    String userName = User.Identity.Name;
    String emailId = request["emailId"];
    var client = account.CreateCloudTableClient();
    var table = client.GetTableReference("Employee");
    var query = table.CreateQuery<EmployeeEntity>().Where("user == '" + userName + "' AND emailId == '" + emailId "'");
    var results = table.ExecuteQuery(query);
...

The query intends to execute the following code:

    user == "<userName>" && emailId == "<emailId>"

However, because the query is constructed dynamically by concatenating a constant query string and user input, the query only behaves correctly if emailId does not contain a single-quote character. If an attacker with the user name wiley enters the string "123' || '4' != '5" for emailId, then the query becomes the following:

    user == 'wiley' && emailId == '123' || '4' != '5'

The addition of the || '4' != '5' condition causes the where clause to always evaluate to true, so the query returns all entries stored in the emails collection, regardless of the email owner.