Arp Spoofing in Sails with Cockroachdb

Arp Spoofing is a Layer 2 attack where an attacker sends falsified Address Resolution Protocol messages to associate their MAC address with the IP of a legitimate host, such as a Cockroachdb node. In a Sails application that communicates with Cockroachdb over the network, this attack can redirect database traffic through the attacker’s machine. Because Sails typically runs as a Node.js service making direct TCP connections to Cockroachdb, the application does not inherently validate layer 2 addressing. If an attacker is on the same network segment (e.g., a shared VPC or container network), they can spoof ARP responses to position themselves between the Sails process and the Cockroachdb nodes.

The exposure is amplified by how Sails handles database configuration. In config/datastores.js, connection details such as hostnames or IPs are used to establish connections. If these endpoints are reachable over a network where ARP is not authenticated, spoofing becomes viable. Cockroachdb’s binary protocol does not include a layer 2 authentication mechanism; it relies on network-level isolation and transport security. Therefore, a spoofed host can intercept queries, observe unencrypted metadata, or even manipulate traffic if TLS is not enforced end-to-end. The risk is not in Sails itself, but in the network path between the Sails service and Cockroachdb, where unauthenticated ARP enables man-in-the-middle positioning.

In clustered or containerized environments, services often discover Cockroachdb hosts via DNS or environment variables, and Sails resolves these to IPs at startup or runtime. An attacker on the same subnet can respond to ARP requests for those IPs before the legitimate node does, leading the Sails app to send sensitive SQL operations through the attacker’s interface. Because Cockroachdb connections may carry row-level data, authentication tokens, and query patterns, intercepted traffic can expose information that leads to further compromise. This is particularly relevant when network segmentation is weak or flat, and when security groups rely solely on IP allowlists without link-layer hardening.

Remediation focuses on ensuring that traffic between Sails and Cockroachdb cannot be intercepted or redirected via ARp Spoofing. The primary controls are network isolation and transport encryption, not ARP manipulation within the application. Use dedicated network peering, private endpoints, and strict security group rules to limit exposure to trusted hosts.

Enforce TLS for all Cockroachdb connections

Ensure your Sails app connects to Cockroachdb using TLS. This prevents plaintext interception even if ARP spoofing occurs. Configure your datastore to use certificates:

module.exports.datastores = {
  default: {
    adapter: 'sails-hook-orm-cockroachdb',
    url: 'postgresql://myuser:[email protected]:26257/mydb?sslmode=verify-full&sslrootcert=/path/to/ca.crt&sslcert=/path/to/client.crt&sslkey=/path/to/client.key',
    pool: {
      max: 30,
      min: 10
    }
  }
};

Use host header validation and IP literals with firewalling

In config/datastores.js, prefer using internal IPs or private DNS names that are not routable from untrusted networks. Combine this with node-level firewall rules that restrict source IPs to known Sails service CIDRs:

module.exports.datastores = {
  staging: {
    adapter: 'sails-hook-orm-cockroachdb',
    url: 'postgresql://staging_user:[email protected]:26257/staging_db?sslmode=require',
    ssl: true
  }
};

On the Cockroachdb side, ensure node IPs are pinned in the cluster and that SQL listeners are bound only to private interfaces. Use firewall rules to block inbound ARP from unexpected MACs on the database subnet.

Network-level protections

While not a Sails code change, enable switch port security, static ARP entries for critical database endpoints, or 802.1X where supported. In cloud environments, use VPC peerings and security groups that deny cross-subnet ARP responses. These measures reduce the attack surface that makes ARP spoofing effective against Sails-to-Cockroachdb traffic.