Beast Attack in Nestjs with Cockroachdb

A Beast Attack (Binding Exception, Attribute Squandering, or similar injection of malicious bindings) in a NestJS application using CockroachDB typically occurs when user-controlled data is used to dynamically influence database connection behavior, query construction, or ORM mapping without strict validation. In this stack, the risk arises at the intersection of NestJS’s dynamic module system and CockroachDB’s SQL interface.

Consider a service that builds repository or query options from request parameters. If an attacker can inject a binding such as ssl, connectionString, or a mapping key used by TypeORM or Prisma to select a database schema or instance, they may redirect queries to an attacker-controlled endpoint or bypass intended schema isolation. CockroachDB’s connection string parameters (e.g., sslmode, cert, host) are especially sensitive: a maliciously crafted binding can enforce insecure modes or point to a rogue server, enabling credential theft or query interception even when the application logic appears constrained.

In a typical NestJS + TypeORM + CockroachDB setup, the vulnerability surface includes:

• Dynamic injection of database names or schemas into repository calls based on unvalidated input.
• Use of raw query builders where table or column identifiers are concatenated rather than parameterized.
• Exploitable bindings in the ORM layer that map to CockroachDB-specific settings, such as ssl or connect_timeout, which can be overridden to weaken security posture.

For example, if a controller accepts a tenantId and uses it to select a schema name without strict allowlisting, an attacker may supply a value like "public" or a maliciously crafted identifier that maps to a different CockroachDB node or role. Because CockroachDB supports distributed SQL and multi-region configurations, an incorrect binding could route queries to an unintended region or instance, exposing cross-tenant data or enabling privilege escalation through misconfigured node permissions.

The risk is amplified when the application uses raw SQL or query builders without sanitizing identifiers. Identifiers such as table or column names cannot be parameterized in SQL, so if they are derived from user input, an attacker may perform identifier injection to execute arbitrary statements or extract data via CockroachDB’s SQL interface. Even when using an ORM, dynamic configuration objects that include CockroachDB-specific flags can be overridden via prototype pollution or nested property injection, leading to insecure defaults being applied at runtime.

Remediation focuses on strict input validation, safe query construction, and eliminating dynamic bindings that map to CockroachDB connection or query parameters. Below are concrete, idiomatic examples in NestJS that mitigate Beast Attack vectors.

1. Validate and restrict schema/tenant selection

Never directly interpolate user input into schema or database names. Use an allowlist and map to a safe identifier.

import { Injectable } from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import { Repository } from 'typeorm';
import { Tenant } from './tenant.entity';

@Injectable()
export class TenantService {
  constructor(
    @InjectRepository(Tenant)
    private readonly tenantRepo: Repository,
  ) {}

  async getTenantSchema(tenantId: string): Promise {
    const allowed = ['tenant_a', 'tenant_b', 'tenant_c'];
    if (!allowed.includes(tenantId)) {
      throw new Error('Invalid tenant');
    }
    // Safe: tenantId is from allowlist, used only as logical key, not SQL identifier
    return tenantId;
  }
}

2. Use parameterized queries and avoid identifier injection

When using TypeORM with CockroachDB, prefer parameterized queries for values and strict allowlisting for identifiers.

import { Injectable } from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import { Repository } from 'typeorm';
import { Product } from './product.entity';

@Injectable()
export class ProductService {
  constructor(
    @InjectRepository(Product)
    private readonly productRepo: Repository,
  ) {}

  async findProductsByCategory(categoryId: number, userSuppliedSort: string) {
    // Safe: categoryId is parameterized; sort is allowlisted
    const allowedSort = ['name', 'created_at'];
    const sortClause = allowedSort.includes(userSuppliedSort) ? userSuppliedSort : 'created_at';

    // Using query builder with parameterized values
    return this.productRepo
      .createQueryBuilder('product')
      .where('product.category_id = :categoryId', { categoryId })
      .orderBy(`product.${sortClause}`, 'ASC')
      .getMany();
  }
}

3. Secure connection settings and avoid runtime overrides

Define CockroachDB connection options in a secure, static configuration. Do not allow runtime overrides of sensitive flags such as sslmode or cert.

// src/database.config.ts
import { TypeOrmModuleOptions } from '@nestjs/typeorm';

export const cockroachConfig: TypeOrmModuleOptions = {
  type: 'cockroachdb',
  host: process.env.COCKRACHDB_HOST || 'localhost',
  port: parseInt(process.env.COCKRACHDB_PORT, 10) || 26257,
  username: process.env.COCKRACHDB_USER || 'root',
  password: process.env.COCKRACHDB_PASSWORD || '',
  database: process.env.COCKRACHDB_DB || 'defaultdb',
  ssl: {
    // Enforce secure mode; do not allow runtime changes based on user input
    rejectUnauthorized: true,
    ca: process.env.COCKRACHDB_CA_PATH ? require('fs').readFileSync(process.env.COCKRACHDB_CA_PATH) : undefined,
  },
  entities: [__dirname + '/../**/*.entity{.ts,.js}'],
  synchronize: false,
};

// src/app.module.ts
import { Module } from '@nestjs/common';
import { TypeOrmModule } from '@nestjs/typeorm';
import { cockroachConfig } from './database.config';

@Module({
  imports: [TypeOrmModule.forRoot(cockroachConfig)],
  // ... other modules
})
export class AppModule {}

4. Sanitize and encode identifiers in raw SQL

If you must use dynamic identifiers, map them through a strict lookup table and quote them using the driver’s identifier quoting.

import { Injectable } from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import { Repository } from 'typeorm';
import { Pool } from 'pg';

@Injectable()
export class SafeQueryService {
  constructor(
    @InjectRepository(Product)
    private readonly productRepo: Repository,
    @Inject('COCKROACH_POOL')
    private readonly pool: Pool,
  ) {}

  async getProductsInTable(tableHint: string) {
    const allowedTables = { products: 'products', audits: 'audit_log' };
    const tableName = allowedTables[tableHint];
    if (!tableName) {
      throw new Error('Invalid table');
    }
    // Use quoting to prevent identifier injection
    const quotedTable = this.pool.escapeIdentifier(tableName);
    const result = await this.pool.query(`SELECT * FROM ${quotedTable} WHERE deleted = $1`, [false]);
    return result.rows;
  }
}

5. Apply principle of least privilege in CockroachDB roles

Ensure the database user used by NestJS has only the permissions required for its operations. Avoid granting schema-wide privileges that could be abused if identifier injection occurs.