From bb01b817cb3edddf285a504d4795778a07c40ece Mon Sep 17 00:00:00 2001
From: sandiyochristan <sandichrist6@gmail.com>
Date: Sun, 29 Mar 2026 06:24:31 +0530
Subject: [PATCH] fix: correct $where version boundary, fix Pro Tip #3, add
 Cassandra CQL injection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three reviewer findings addressed:

P1 — $where version boundary: corrected from 'disabled by default in
MongoDB 4.4+' to 'disabled by default in MongoDB 7.0+'. MongoDB 4.4
deprecated server-side JavaScript but left javascriptEnabled defaulting
to true; the feature was not disabled by default until 7.0. The section
now explicitly notes that 4.4-6.x targets are still exploitable unless
explicitly hardened.

P1 — Pro Tip #3: updated to match the corrected version boundary.
Previous text 'available and dangerous on pre-4.4' contradicted the
main section and would cause testers to skip $where on 4.4-6.x. Now
states 'active by default on pre-7.0 instances, including 4.4-6.x'.

P1 — Cassandra coverage gap: the introduction claimed Cassandra as a
covered attack surface but the skill body had no Cassandra content.
Added Cassandra to the Attack Surface section (CQL injection, ALLOW
FILTERING predicates, UDF injection) and added a Cassandra CQL
Injection subsection in Key Vulnerabilities covering string
concatenation injection, authentication bypass, and boolean extraction.
---
 .../skills/vulnerabilities/nosql_injection.md | 33 +++++++++++++++++--
 1 file changed, 31 insertions(+), 2 deletions(-)

diff --git a/strix/skills/vulnerabilities/nosql_injection.md b/strix/skills/vulnerabilities/nosql_injection.md
index 5c6da7d2..a5860e24 100644
--- a/strix/skills/vulnerabilities/nosql_injection.md
+++ b/strix/skills/vulnerabilities/nosql_injection.md
@@ -31,6 +31,11 @@ NoSQL injection exploits the mismatch between how applications pass user input t
 - Filter expression injection (PartiQL, FilterExpression operators)
 - Attribute name/value collisions in expression maps
 
+**Cassandra**
+- CQL injection via string concatenation into `SELECT`/`INSERT`/`UPDATE` statements
+- `ALLOW FILTERING` queries with injected predicates
+- User-defined function (UDF) injection when user input flows into function bodies
+
 **CouchDB**
 - JavaScript `_design` document injection via Mango query selectors
 - MapReduce function injection if user controls design doc content
@@ -102,7 +107,7 @@ Binary search the character space to minimize requests. Works on any string fiel
 
 ### `$where` JavaScript Injection
 
-If `$where` operator is enabled (disabled by default in MongoDB 4.4+), inject arbitrary server-side JavaScript:
+If `$where` operator is enabled (disabled by default in MongoDB 7.0+; MongoDB 4.4–6.x deprecated it but left `javascriptEnabled` defaulting to `true`), inject arbitrary server-side JavaScript:
 ```json
 {"$where": "function(){return this.username == 'admin' && sleep(2000)}"}
 {"$where": "function(){return this.role == 'admin'}"}
@@ -158,6 +163,30 @@ SELECT * FROM Users WHERE username = 'input'
 SELECT * FROM Users WHERE username = 'x' OR '1'='1
 ```
 
+### Cassandra CQL Injection
+
+Cassandra Query Language (CQL) is syntactically similar to SQL. When user input is concatenated directly into CQL statements rather than using prepared statements (`session.prepare()`), injection is possible:
+
+```python
+# Vulnerable — string concatenation
+query = f"SELECT * FROM users WHERE username = '{username}'"
+
+# Injected: username = "' OR '1'='1
+SELECT * FROM users WHERE username = '' OR '1'='1'
+```
+
+**Authentication bypass:**
+```
+username: ' OR '1'='1' ALLOW FILTERING --
+```
+
+**Token extraction via UNION-style (Cassandra supports `IN` lists):**
+```
+username: 'x' OR token(username) > token('a') ALLOW FILTERING--
+```
+
+Cassandra does not support `SLEEP` or out-of-band primitives natively, so injection detection relies on boolean/error responses. Prepared statements (parameterized queries via the driver's `execute(prepared, [values])`) are the complete fix.
+
 ## Bypass Techniques
 
 **Type Coercion**
@@ -214,7 +243,7 @@ SELECT * FROM Users WHERE username = 'x' OR '1'='1
 
 1. Always try both JSON body (`{"field": {"$ne": null}}`) and bracket-notation form (`field[$ne]=`) — different middleware handles them differently
 2. Target reset token and API key fields with `$regex` extraction, not just passwords
-3. Check MongoDB driver version via error messages; `$where` is available and dangerous on pre-4.4
+3. Check MongoDB version via error messages or `/admin/serverStatus`; `$where` is active by default on pre-7.0 instances — that includes 4.4–6.x targets where `javascriptEnabled` was deprecated but not yet disabled, making them still exploitable unless explicitly hardened
 4. In Mongoose, `{strict: false}` passes arbitrary operators to MongoDB — grep the codebase if you have access
 5. For Elasticsearch, try `_cat/indices`, `_mapping`, and `_search` with `query_string: *` before attempting script injection
 6. Redis injection requires newline characters (`\r\n`) in the injected value — verify URL encoding handling in the chain