Question

For say a MySQL database there are known security issues. How does this apply to a NoSQL db? e.g. Injections, xss etc. What are the security measurement you have to take when using a NoSQL db? Specifically regarding MongoDB (with node-mongodb-native) and Node.js (using Express)

And if so, are there any modules for Node/Express that helps in preventing this?

Answer 1

There is specific issue for NodeJS, MongoDB (and some others NoSQL databases that heavily use javascript): serverside javascript injection. Look here and here (pdf) for details. It is more like SQL injection than XSS.

Shortly, that is when attacker sends javascript to your nodejs or mongodb when you’re expecting just JSON. So theoretically bad guy can bring your service down (DOS), access your data and even filesystem.

To prevent such attacks you have to:

1. Avoid creating “ad-hoc” JavaScript commands by concatenating script
   with user input.
2. Validate user input used in SSJS commands with regular expressions.
3. Avoid use of the JavaScript eval command. In particular, when parsing JSON input, use a safer alternative such as
   JSON.parse.