Description

Detects potential NoSQL injection vulnerabilities in Elixir MongoDB queries where user input may be directly interpolated into query filters without proper sanitization. This can allow attackers to manipulate database queries by injecting malicious operators or conditions, potentially leading to unauthorized data access or bypassing authentication mechanisms.

Detection Strategy

• Analyzes Elixir source code for MongoDB query operations

• Examines function calls and query construction patterns in selected code locations

• Identifies MongoDB filter operations that may accept unsanitized user input

• Reports vulnerability when query filters are built using potentially unsafe input concatenation or interpolation

• Focuses on scenarios where external data flows into MongoDB query parameters without proper validation or escaping

Vulnerable code example

defmodule VulnerableApp do
  def user_login(conn, topology) do
    # VULNERABLE: entire filter structure comes from user input
    filter = conn.params["credentials"]
    Mongo.find_one(topology, "users", filter)
  end

  def search_users(conn, topology) do...

✅ Secure code example

defmodule VulnerableApp do
  def user_login(conn, topology) do
    # Get individual credential fields from user input
    username = conn.params["username"]
    password = conn.params["password"]
    
    # SAFE: construct filter with fixed keys, only values from user input
    filter = %{"username" => username, "password" => password}...