The Core Reason:

MongoDB allows special operator objects such as:

$ne (not equal)
$gt, $lt
$regex
$or
$in

Vulnerable Code (because user input is passed directly)

// ❌ VULNERABLE

app.post("/login", async (req, res) => {

const user = await db.collection("users").findOne({

name: req.body.name,

password: req.body.password

});

if (user) res.send("Logged in!");

else res.send("Invalid credentials");

});

Why this is vulnerable

Because MongoDB allows operators like:

{ "$ne": "0" }

{ "$gt": "" }

{ "$regex": ".*" }

{ "$or": [...] }

{ "$in": [...] }

1. If the attacker sends JSON instead of a string:

{

"name": "jeremy",

"password": { "$ne": "" }

}

This returns the user even when the attacker does not know the password.

2. Example with $gt / $lt

{

"name": "john",

"age": { "$gt": 0 }

}

This matches any user with age > 0.

3. Example with $regex

Attacker sends:

{ "name": { "$regex": ".*" } }

This matches every user, bypassing intended filtering.

4. Example with $or

Attacker sends:

{
  "name": "admin",
  "role": { "$or": [ {}, { "$ne": "" } ] }
}

5. Example with $in

Attacker sends:

{
  "category": { "$in": ["electronics", "clothing", "*"] }
}

Root cause of all vulnerable queries
All of these vulnerabilities happen because:

User input is inserted directly into MongoDB query objects.

MongoDB interprets special operator keys like $ne, $gt, $lt, $regex, $or, $in, etc. If a user can send objects, they can inject new logic.

Mitigation:
Validate and sanitize (clean and remove dangerous parts of user input)
NEVER pass raw user input directly into MongoDB queries

Use schema validation libraries