NoSQL Sleep does not seem to work[๐]
See original GitHub issue๐ Bug report
Description
The NoSQL Sleep Solution does not seem to work using the latest Docker image.
Starting the server with docker run --rm -p 3000:3000 bkimminich/juice-shop
and using the solution found in: https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/appendix/solutions.html under โLet the server sleep for some timeโ
I am using Insomnia to make the call. I get back a 200, but the NoSQL instance does not sleep, and the solution is not registered.
The following curl request reproduces it locally: curl --request GET --url โhttp://localhost:3000/rest/products/sleep(100)/reviewsโ
Is this a regression?
I assume itโs a regression, but I donโt know any working version.
๐ฌ Minimal Reproduction
- docker run --rm -p 3000:3000 bkimminich/juice-shop
- curl --request GET --url โhttp://localhost:3000/rest/products/sleep(100)/reviewsโ
๐ฅ Exception or Error
No error, I get back a 200 with a success.
๐ณ Your Environment
Latest docker image running locally on latest macOS.
Issue Analytics
- State:
- Created 3 years ago
- Comments:6 (3 by maintainers)
Top Results From Across the Web
NoSQL Sleep does not seem to work[๐] ยท Issue #1465 - GitHub
I am using Insomnia to make the call. I get back a 200, but the NoSQL instance does not sleep, and the solution...
Read more >Analysis and Mitigation of NoSQL Injections - InfoQ
This injection looks very similar to classic SQL injections. The defense against such an attack is to disable the use of JavaScript execution...
Read more >How to Test and Prevent NoSQL Injections - Cyolo
Injections are one of the most common web application vulnerabilities. In this article, we examine how to identify, test, and prevent NoSQL injections...
Read more >What exactly is NoSQL? - Level Up Coding
In simple words, NoSQL is a new data storage backend that does not follow the relational DB model. That means we are speaking...
Read more >How to avoid Mongo DB NoSQL blind (sleep) injection
While scanning my Application for vulnerability, I have got one high risk error i.e.. Blind MongoDB NoSQL Injection.
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Thank you for the help! It turned out to be
NODE_ENV=unsafe
. The solution worked ๐ .This thread has been automatically locked because it has not had recent activity after it was closed. ๐ Please open a new issue for regressions or related bugs.