Summary
Could not find express-mongo-sanitize or any equivalent request-sanitization middleware anywhere in the backend. Login credentials are parsed from JSON via body-parser and handed to passport-local-mongoose's authenticate(), which builds its lookup query from the raw parsed field.
Status
Not yet confirmed exploitable — this needs an actual live test (e.g. sending a payload where email/password are objects containing Mongo query operators instead of strings, against a throwaway/seeded test account) before treating it as a live finding. Flagging so it doesn't get lost, since the absence of any sanitization layer is itself worth fixing regardless of whether this specific login path turns out to be exploitable.
Suggested fix
Add express-mongo-sanitize (or equivalent manual type-checking on req.body fields expected to be strings) as global middleware in backend/index.js, and verify the login path specifically once that's in place.
Summary
Could not find
express-mongo-sanitizeor any equivalent request-sanitization middleware anywhere in the backend. Login credentials are parsed from JSON viabody-parserand handed topassport-local-mongoose'sauthenticate(), which builds its lookup query from the raw parsed field.Status
Not yet confirmed exploitable — this needs an actual live test (e.g. sending a payload where
email/passwordare objects containing Mongo query operators instead of strings, against a throwaway/seeded test account) before treating it as a live finding. Flagging so it doesn't get lost, since the absence of any sanitization layer is itself worth fixing regardless of whether this specific login path turns out to be exploitable.Suggested fix
Add
express-mongo-sanitize(or equivalent manual type-checking onreq.bodyfields expected to be strings) as global middleware inbackend/index.js, and verify the login path specifically once that's in place.