How to fix NoSQL Injection
in ASP.NET Core
Executive Summary
NoSQL injection is the silent killer in modern web stacks. Devs often assume 'No SQL' means no injection, but that's a rookie mistake. In ASP.NET Core, if you're concatenating strings into MongoDB filters or passing raw BsonDocuments from untrusted input, you're handing over the keys to the kingdom. Attackers can use operators like $gt, $ne, or $where to bypass authentication or dump entire collections.
The Vulnerable Pattern
public async Task GetUser(string username, string password) {
// DANGER: Raw JSON string construction with user input
var filter = "{ 'Username': '" + username + "', 'Password': '" + password + "' }";
return await _collection.Find(filter).FirstOrDefaultAsync();
} The Secure Implementation
The vulnerable code uses string interpolation to build a JSON query. An attacker can provide a payload like 'admin', and a password like '{ "$ne": "1" }' to bypass authentication entirely. The secure version leverages the MongoDB .NET Driver's FilterDefinitionBuilder. This API treats user input as literal values (data) rather than executable operators (code). By using typed expressions, the driver automatically handles the serialization and sanitization, effectively neutralizing any injected NoSQL operators.
public async Task GetUser(string username, string password) {
// SECURE: Use the strongly-typed FilterDefinitionBuilder
var filter = Builders.Filter.And(
Builders.Filter.Eq(u => u.Username, username),
Builders.Filter.Eq(u => u.Password, password)
);
return await _collection.Find(filter).FirstOrDefaultAsync();
}
Your ASP.NET Core API
might be exposed to NoSQL Injection
74% of ASP.NET Core apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.