Description

Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-06T15:17:19.017Z",
  "pubdate": "2026-11-06T15:17:19.017Z",
  "executiveSummary": "Openwhyd versions prior to 1.65.1 are susceptible to a critical NoSQL injection vulnerability within the user lookup functionality. This flaw arises from the improper sanitization of user-supplied input when processing database queries via the /api/user endpoint.\nThe vulnerability allows an unauthenticated remote attacker to manipulate MongoDB query structures by submitting JSON objects instead of expected string identifiers in the 'id' parameter. By leveraging MongoDB query operators such as '$ne' (not equal) or '$gt' (greater than), an attacker can bypass standard lookup constraints to extract, enumerate, and access sensitive public profile data belonging to other users.\nThe risk implication is significant as it facilitates unauthorized data exposure without requiring elevated privileges or authenticated sessions. Successful exploitation permits the systematic harvesting of user information through automated query manipulation. This flaw highlights a critical failure in input validation where application logic fails to distinguish between literal identifiers and structural database command objects.",
  "technicalDetails": "The root cause of this vulnerability is the application's failure to enforce type-checking and sanitization on the 'id' parameter processed by the POST /api/user endpoint. The backend implementation passes the user-supplied input directly into a MongoDB query builder without validating that the input strictly adheres to an expected string or objectID format.\nIn a secure implementation, the 'id' parameter should be treated as a primitive identifier. However, because the application uses a JavaScript-based runtime with a document-oriented database, the parser accepts structured JSON objects. An attacker can craft a malicious request body containing MongoDB operator objects, such as {'id': {'$ne': null}}. When this payload reaches the database layer, the query engine interprets the object as a command rather than a literal value.\nThe attack flow follows a structured pattern: first, the attacker targets the /api/user endpoint via an HTTP POST request. Second, instead of providing a standard alphanumeric string, the attacker injects a JSON object containing advanced query selectors. For instance, by providing {'id': {'$gt': ''}}, the attacker influences the database logic to return records that satisfy the injected condition, effectively forcing the database to leak entries that would otherwise remain unreachable.\nThe vulnerable component resides in the data access layer responsible for fetching user profile information. Because the application logic does not sanitize or cast these parameters, the MongoDB driver executes the malicious query with the privileges of the database service user. This enables the attacker to enumerate user records by iterating through various query operators to filter and extract profiles sequentially.\nThis vulnerability is particularly severe because it requires zero authentication and possesses no specific privilege requirements, allowing any network-exposed user to interact with the API. The post-exploitation impact includes the mass scraping of user profile metadata, which can be aggregated to build a database of system users or mapped to identify further attack vectors within the application ecosystem. The lack of input restriction effectively transforms a simple lookup API into a tool for unauthorized data retrieval."
}