Arp Spoofing in Restify

Detecting ARP spoofing vulnerabilities in Restify applications requires examining both the runtime behavior and the middleware configuration. middleBrick's API security scanner includes specific checks for Restify applications that can identify these issues without requiring access to your source code.

For Restify applications, middleBrick performs several key detection steps:

• Request size validation testing: The scanner sends requests with oversized headers and payloads to detect missing size limits in bodyParser configuration
• Query parameter depth analysis: Tests for deep nesting vulnerabilities by sending requests with multiple levels of bracket notation
• Header injection testing: Attempts to inject malicious headers that could exploit Restify's request processing pipeline
• Rate limiting bypass detection: Since ARP spoofing can be used to distribute attacks across multiple IP addresses, middleBrick tests whether your Restify application has proper rate limiting in place

The scanner specifically looks for Restify's default configurations that may be vulnerable. For example, it checks if bodyParser is used without size limits:

{
  "findings": [
    {
      "category": "Input Validation",r>      "severity": "high",r>      "restify_specific": true,
      "description": "bodyParser used without size limits",r>      "recommendation": "Add maxBodySize to bodyParser configuration",r>      "code_sample": "server.use(restify.plugins.bodyParser({ maxBodySize: 1048576 }))"
    }
  ]
}

middleBrick also detects missing query parser limits and can identify when Restify's audit logger is configured without proper log rotation or size limits, which could be exploited through ARP spoofing to cause denial of service.

Securing Restify applications against ARP spoofing attacks requires implementing specific configuration changes and middleware safeguards. Here are Restify-specific remediation strategies with working code examples:

1. Configure bodyParser with strict limits:

const restify = require('restify');
const server = restify.createServer();

// Secure configuration with explicit limits
server.use(restify.plugins.bodyParser({
  maxBodySize: 1024 * 1024, // 1MB limit
  mapParams: false, // Disable automatic parameter mapping
  overrideParams: false // Prevent parameter override
// For JSON specifically with strict validation
server.use(restify.plugins.bodyParser({
  maxBodySize: 1024 * 1024,
  mapParams: false,
  overrideParams: false,
  jsonBody: true,
  reviver: (key, value) => {
    // Custom validation to reject malicious structures
    if (typeof value === 'object' && Object.keys(value).length > 100) {
      throw new Error('Excessive object depth');
    }
    return value;
  }

2. Secure query parsing with depth limits:

const querystring = require('querystring');

// Custom query parser with depth limiting
function safeQueryParser(req, res, next) {
  const query = req.url.split('?')[1];
  
  try {
    // Parse with depth limiting
    const parsed = querystring.parse(query, null, null, {
      depth: 5 // Limit nesting depth
    });
    req.query = parsed;
    next();
  } catch (err) {
    res.send(400, { error: 'Invalid query parameters' });
    next(false);
  }
}

server.use(safeQueryParser);

3. Implement rate limiting and request validation:

const rateLimit = require('express-rate-limit');

// Rate limiting middleware for Restify
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests
  message: 'Too many requests from this IP'
});

server.use(limiter);

// Custom validation middleware
function validateRequest(req, res, next) {
  const { headers, url } = req;
  
  // Check for oversized headers
  const totalHeaderSize = Object.keys(headers).reduce((sum, key) => {
    return sum + key.length + (headers[key] || '').length;
  }, 0);
  
  if (totalHeaderSize > 8192) {
    return res.send(413, { error: 'Header too large' });
  }
  
  // Check URL length
  if (url.length > 2048) {
    return res.send(414, { error: 'URL too long' });
  }
  
  next();
}

server.use(validateRequest);

4. Secure audit logging:

const fs = require('fs');
const path = require('path');

// Audit logger with size limits and rotation
const auditLogPath = path.join(__dirname, 'audit.log');

function createAuditLogger() {
  let logSize = 0;
  
  return (event, req, res, next) => {
    const logEntry = JSON.stringify({
      event,
      timestamp: new Date().toISOString(),
      method: req.method,
      url: req.url,
      remoteAddress: req.connection.remoteAddress,
      userAgent: req.headers['user-agent'] || 'unknown'
    });
    
    // Check log size before writing
    const entrySize = logEntry.length;
    if (logSize + entrySize > 10 * 1024 * 1024) { // 10MB max
      // Rotate log: keep last 5MB, discard older
      const data = fs.readFileSync(auditLogPath, 'utf8');
      const lines = data.split('\n');
      const keepLines = lines.slice(-Math.floor(5 * 1024 * 1024 / 100)); // Approx 5MB
      fs.writeFileSync(auditLogPath, keepLines.join('\n'));
      logSize = keepLines.join('\n').length;
    }
    
    fs.appendFileSync(auditLogPath, logEntry + '\n');
    logSize += entrySize;
    next();
  };
}

server.on('after', createAuditLogger());