NoSQL Injection: DynamoDB

Constructing a dynamic DynamoDB query with input from an untrusted source could allow an attacker to modify the statement's meaning.

NoSQL injection vulnerabilities in DynamoDB can occur when:

1. Data enters a program from an untrusted source.



2. The data is used to dynamically construct a DynamoDB query.

Example 1: The following code dynamically constructs and executes a DynamoDB query that searches for a user given their email address or username, along with their password.

    ...
        // "type" parameter expected to be either: "Email" or "Username"
        string type = request["type"];
        string value = request["value"];
        string password = request["password"];
        
        var ddb = new AmazonDynamoDBClient();
    
        var attrValues = new Dictionary<string,AttributeValue>();
        attrValues[":value"] = new AttributeValue(value);
        attrValues[":password"] = new AttributeValue(password);
    
        var scanRequest = new ScanRequest();
        scanRequest.FilterExpression = type + " = :value AND Password = :password";
        scanRequest.TableName = "users";
        scanRequest.ExpressionAttributeValues = attrValues;
    
        var scanResponse = await ddb.ScanAsync(scanRequest);
    ...
    

The query intends to execute the following code:

Email = :value AND Password = :password

or

Username = :value AND Password = :password

However, because the query is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if type only contains any of the expected values. If an attacker provides a type value such as :value = :value OR :value, then the query becomes the following:

:value = :value OR :value = :value AND Password = :password

The addition of the :value = :value condition causes the where clause to always evaluate to true, so the query returns all entries stored in the users collection, regardless of the email owner.