Arp Spoofing in Sails with Firestore

Arp Spoofing is a Layer 2 network attack where an attacker sends falsified Address Resolution Protocol messages to associate their MAC address with the IP of a legitimate host, such as a gateway or another server. In a Sails.js application that uses Google Cloud Firestore as its backend datastore, the attack surface is shaped by how the app resolves hosts and transports requests to Firestore.

When a Sails app runs in an environment such as a container, VM, or shared network, an attacker on the same local network can perform Arp Spoofing to intercept traffic intended for the Firestore endpoint. Because Firestore client libraries typically resolve the host once and maintain long-lived HTTPS connections, an intercepted request may expose authentication tokens and project identifiers embedded in the requests. Even though Firestore enforces authentication via IAM and signed requests, the exposure of session tokens or service account credentials over a compromised path can enable request tampering or replay. This becomes especially relevant for Sails apps that proxy Firestore calls through custom controllers or services without enforcing strict transport-layer integrity checks.

Moreover, if the Sails app dynamically determines Firestore hostnames based on configuration or environment variables that are manipulated via ARP cache poisoning, the app may unwittingly route requests to a malicious host. Such a setup does not directly modify Firestore data but undermines the integrity of the communication channel, violating the trust model that Sails and Firestore rely on. The risk is compounded in development or staging setups where network segmentation is weak and monitoring of ARP behavior is absent.

middleBrick detects this class of issue as part of its unauthenticated black-box scans, flagging insecure network configurations and missing host integrity checks under the SSRF and Inventory Management checks. The scanner highlights risks where an attacker might influence routing without needing authenticated access to Firestore itself.

Remediation focuses on ensuring that Firestore interactions in Sails are resilient to network-layer tampering. You should enforce strict host resolution, validate server certificates, and avoid leaking sensitive identifiers in logs or error messages. The following practices and code samples illustrate secure patterns.

1. Enforce explicit host configuration and certificate validation

Initialize the Firestore client with explicit host settings and custom HTTPS agents that enforce strong certificate validation. This reduces reliance on runtime hostname resolution that can be poisoned.

const {Firestore} = require('@google-cloud/firestore');
const https = require('https');

const firestore = new Firestore({
  projectId: process.env.GCP_PROJECT_ID,
  keyFilename: process.env.GCP_KEYFILE,
  databaseId: process.env.FIRESTORE_DATABASE,
  // Explicitly set the host to a verified value
  host: 'firestore.googleapis.com',
  // Enforce TLS 1.2+ and strict certificate checks
  httpsAgent: new https.Agent({
    rejectUnauthorized: true,
    minVersion: 'TLSv1.2',
  }),
});

// Verify connectivity by fetching a known document metadata
async function verifyFirestoreHost() {
  const doc = firestore.doc('healthcheck/ping');
  const snapshot = await doc.get({metadata: true});
  console.log('Firestore host verified:', snapshot.metadata.fromCache ? 'cache' : 'remote');
}
verifyFirestoreHost().catch(console.error);

2. Use Application Default Credentials securely in Sails services

In Sails, encapsulate Firestore access in a dedicated service that validates inputs and does not expose credentials via logs. Ensure environment variables are sourced from secure vaults and not hardcoded.

// api/services/FirestoreService.js
const {Firestore} = require('@google-cloud/firestore');

module.exports = {
  client: null,
  async initialize() {
    this.client = new Firestore({
      projectId: sails.config.custom.firestore.projectId,
      keyFilename: sails.config.custom.firestore.keyFilename,
    });
    sails.log.info('Firestore client initialized with fixed host configuration');
  },
  async getDocument(collection, id) {
    if (!collection || typeof id !== 'string') {
      throw new Error('Invalid document reference');
    }
    const doc = this.client.doc(`${collection}/${id}`);
    const snapshot = await doc.get();
    if (!snapshot.exists) {
      throw new Error('Document does not exist');
    }
    return snapshot.data();
  },
};

3. Monitor and harden the runtime environment

Ensure your Sails deployment uses static IP egress rules where possible and monitor DNS and ARP behavior in CI/CD pipelines. While Firestore client libraries already perform certificate pinning at the HTTP layer, reinforcing network-level controls adds defense-in-depth.

4. Validate Firestore Rules alongside transport security

Transport security must complement Firestore security rules. Use rules that enforce ownership and least privilege. Example rule snippet:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}