Depending on your ODM, similar vulnerabilities may exist. For example, if you have a user finder that expects an ID parameter id=1 User.where(:id => pa

Depending on your ODM, similar vulnerabilities may exist. For example, if you have a user finder that expects an ID parameter id=1 User.where(:id => params[:id]).first User.where(:id => 1).first Then I could construct a hash in the param: id[$gt]=0 This would perform the following find: User.where(:id => params[:id]).first User.where(:id => {"$gt" => 0}).first Which will return the first user record (probably). You should be performing casts (usually to strings) before you pass your data to your ODM. id[$gt]=0 User.where(:id => params[:id].to_s).first User.where(:id => "{:$gt=>0}").first This will correctly fail to a find a document.