Arp Spoofing in Hapi with Cockroachdb

Arp Spoofing is a Layer 2 attack where an attacker sends falsified Address Resolution Protocol messages to associate their MAC address with the IP address of another host, typically the default gateway or a database server. When a Hapi application communicates with a Cockroachdb cluster over a local network (e.g., within a Kubernetes pod network or a data center LAN), the traffic is often assumed to be trusted. If an attacker successfully spoofs the ARP table for the Cockroachdb node’s IP, the Hapi backend may unknowingly send database queries to the attacker’s machine instead of the legitimate Cockroachdb node.

This combination is particularly risky because Cockroachdb typically uses long-lived connections and may transmit sensitive data such as authentication tokens, row-level information, or encrypted backup metadata. Hapi applications frequently use connection pools that maintain persistent TCP sessions to Cockroachdb, and if an attacker intercepts or alters these flows via ARP manipulation, they can observe, inject, or modify unencrypted or improperly encrypted traffic. Cockroachdb’s wire protocol does not encrypt traffic by default unless explicitly configured, so ARP spoofing can expose query contents, result sets, and configuration details.

The attack surface is amplified in containerized or cloud-native deployments where IP addresses are ephemeral but MAC learning tables may be small. Hapi services running in the same network segment as Cockroachdb nodes without network segmentation allow an attacker to perform ARP spoofing from a compromised pod or adjacent host. Because Cockroachdb supports multi-region replication, an attacker might redirect traffic to a replica in a less-controlled environment to harvest metadata or exploit weaker access controls. MiddleBrick scans detect unauthenticated exposure by identifying missing transport-layer protections and unusual traffic patterns during black-box testing of the API surface that interfaces with Cockroachdb.

Remediation centers on ensuring that all communication between Hapi and Cockroachdb is encrypted and that host identity is verified. Use TLS with certificate validation rather than relying on network-level trust. Configure Cockroachdb to require TLS for all client connections and enforce certificate-based client authentication where applicable.

Below is a concrete Hapi server example using the @cockroachdb/cockroachdb-client driver (or a compatible PostgreSQL client) with TLS enabled. The example loads a CA certificate to validate the server identity and, optionally, a client certificate for mutual TLS.

const Hapi = require('@hapi/hapi');
const { Client } = require('pg'); // CockroachDB wire protocol compatible
const fs = require('fs');

const init = async () => {
  const server = Hapi.server({
    port: 4000,
    host: '0.0.0.0'
  });

  // Configure a secure CockroachDB client with TLS
  const cockroachClient = new Client({
    connectionString: 'postgresql://myuser:[email protected]:26257/mydb?sslmode=verify-full',
    ssl: {
      ca: fs.readFileSync('/etc/certs/ca.crt').toString(),
      cert: fs.readFileSync('/etc/certs/client.crt').toString(),
      key: fs.readFileSync('/etc/certs/client.key').toString(),
      rejectUnauthorized: true
    }
  });

  await cockroachClient.connect();

  server.route({
    method: 'GET',
    path: '/user/{id}',
    handler: async (request, h) => {
      const { id } = request.params;
      const res = await cockroachClient.query('SELECT id, email, name FROM users WHERE id = $1', [id]);
      return res.rows[0];
    }
  });

  await server.start();
  console.log('Server running on %s', server.info.uri);
};

process.on('unhandledRejection', (err) => {
  console.error(err);
  process.exit(1);
});

init();

Key points in this configuration:

• sslmode=verify-full ensures the server certificate matches the hostname and is signed by the provided CA, preventing man-in-the-middle via ARP spoofing.
• Providing ca, cert, and key enforces mutual TLS, so even if an attacker spoofs ARP, they cannot present a valid certificate accepted by the client.
• Avoid sslmode=disable or require in production; these modes do not validate server identity and leave traffic vulnerable to interception.

On the Cockroachdb side, ensure nodes are configured with certificates and that the cluster enforces TLS for all external connections. Use network policies to restrict which IP ranges can reach Cockroachdb ports (26257 for SQL, 8080 for HTTP), reducing the feasibility of ARP spoofing by limiting an attacker’s position in the network.

MiddleBrick’s scans can validate that your endpoints do not expose unauthenticated access patterns and that TLS is correctly enforced when interacting with database-backed APIs. The tool’s LLM/AI Security checks are not directly relevant to ARP spoofing but help ensure that no prompt or model endpoint is inadvertently exposed alongside database interfaces.