I've been playing around with Nosql and specifically MongoDB injection on a few challenges and my lab. If you have an injection point you can easily enumerate and dump the database. But can you go beyond that, like the many things you can do with a SQL injection?

More specifically, is there any way to read or write files on the server from a MongoDB injection?

My Google search for that returned empty-handed so I looked at the mongo Database Commands but I didn't see anything obvious there that could be leveraged to read/write to arbitrary files.

  • 1
    What version of MongoDB are you using? This is important because in version 3.0, the javascript interpreter got better sandboxing (especially for MapReduce), but 2.x versions are still widely deployed. – Philipp Oct 15 '15 at 10:57
  • @Philipp Well I'm mostly just trying to expand my knowledge in this area so it would be worth knowing about both cases, especially if 2.x is still widely deployed. – Juicy Oct 15 '15 at 14:06

Your Answer


Browse other questions tagged or ask your own question.