question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. Itย collects links to all the places you might be looking at while hunting down a tough bug.

And, if youโ€™re still stuck at the end, weโ€™re happy to hop on a call to see how we can help out.

NoSQL Sleep does not seem to work[๐Ÿ›]

See original GitHub issue

๐Ÿ› Bug report

Description

The NoSQL Sleep Solution does not seem to work using the latest Docker image.

Starting the server with docker run --rm -p 3000:3000 bkimminich/juice-shop and using the solution found in: https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/appendix/solutions.html under โ€œLet the server sleep for some timeโ€

I am using Insomnia to make the call. I get back a 200, but the NoSQL instance does not sleep, and the solution is not registered.

The following curl request reproduces it locally: curl --request GET --url โ€˜http://localhost:3000/rest/products/sleep(100)/reviewsโ€™

Is this a regression?

I assume itโ€™s a regression, but I donโ€™t know any working version.

๐Ÿ”ฌ Minimal Reproduction

  1. docker run --rm -p 3000:3000 bkimminich/juice-shop
  2. curl --request GET --url โ€˜http://localhost:3000/rest/products/sleep(100)/reviewsโ€™

๐Ÿ”ฅ Exception or Error

No error, I get back a 200 with a success.

๐ŸŒณ Your Environment

Latest docker image running locally on latest macOS.

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Comments:6 (3 by maintainers)

github_iconTop GitHub Comments

1reaction
mfantocommented, Sep 15, 2020

Thank you for the help! It turned out to be NODE_ENV=unsafe. The solution worked ๐Ÿ‘ .

0reactions
github-actions[bot]commented, Sep 16, 2021

This thread has been automatically locked because it has not had recent activity after it was closed. ๐Ÿ”’ Please open a new issue for regressions or related bugs.

Read more comments on GitHub >

github_iconTop Results From Across the Web

NoSQL Sleep does not seem to work[๐Ÿ›] ยท Issue #1465 - GitHub
I am using Insomnia to make the call. I get back a 200, but the NoSQL instance does not sleep, and the solution...
Read more >
Analysis and Mitigation of NoSQL Injections - InfoQ
This injection looks very similar to classic SQL injections. The defense against such an attack is to disable the use of JavaScript execution...
Read more >
How to Test and Prevent NoSQL Injections - Cyolo
Injections are one of the most common web application vulnerabilities. In this article, we examine how to identify, test, and prevent NoSQL injections...
Read more >
What exactly is NoSQL? - Level Up Coding
In simple words, NoSQL is a new data storage backend that does not follow the relational DB model. That means we are speaking...
Read more >
How to avoid Mongo DB NoSQL blind (sleep) injection
While scanning my Application for vulnerability, I have got one high risk error i.e.. Blind MongoDB NoSQL Injection.
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found