Bug Description
The /api/auth/verify-email endpoint extracts the token directly from req.query.token. Express uses the qs library by default, which parses query parameters like ?token[$ne]=null into a JSON object { "$ne": "null" }. This object is passed directly to User.findOne({ emailVerificationToken: token }). An attacker can mass-verify random accounts by sending this NoSQL injection payload, as findOne will simply match the first user whose token is not null.
Steps to Reproduce
- Create a new unverified user account.
- Send a GET request to /api/auth/verify-email?token[$ne]=null.
- Observe that an arbitrary user account (the first one matching the query) becomes verified and its verification token is nulled out.
- Repeat to blindly verify other accounts in the database.
Expected Behavior
The token query parameter should be strictly validated using Zod or explicitly cast to a string (String(req.query.token)) before being used in database queries to prevent object injection.
Actual Behavior
The parameter is passed directly into the MongoDB query, resulting in a severe NoSQL injection vulnerability.
Severity
Critical
Screenshots / Screen Recording
No response
Browser
No response
Operating System
No response
Additional Context
Located in backend/controllers/authController.js.
Bug Description
The /api/auth/verify-email endpoint extracts the token directly from req.query.token. Express uses the qs library by default, which parses query parameters like ?token[$ne]=null into a JSON object { "$ne": "null" }. This object is passed directly to User.findOne({ emailVerificationToken: token }). An attacker can mass-verify random accounts by sending this NoSQL injection payload, as findOne will simply match the first user whose token is not null.
Steps to Reproduce
Expected Behavior
The token query parameter should be strictly validated using Zod or explicitly cast to a string (String(req.query.token)) before being used in database queries to prevent object injection.
Actual Behavior
The parameter is passed directly into the MongoDB query, resulting in a severe NoSQL injection vulnerability.
Severity
Critical
Screenshots / Screen Recording
No response
Browser
No response
Operating System
No response
Additional Context
Located in backend/controllers/authController.js.