Beast Attack in Sails with Cockroachdb

A Beast Attack (Binding Exception for Asymmetric Security) in the context of Sails.js with CockroachDB typically arises when application-level bindings between an authenticated identity and a data access layer are not enforced consistently. Sails controllers often rely on implicit associations, such as using req.me.id to scope queries. If these bindings are not enforced server-side, an attacker can manipulate parameters to access records belonging to other users.

With CockroachDB as the backend, the risk is not in the database itself but in how Sails applications construct queries. For example, a typical Sails model like Reservation might associate records via a foreign key such as user_id. If an endpoint uses a raw query or a Waterline query that omits this binding, an attacker can modify request parameters to substitute another user ID and retrieve or modify data they should not access.

Consider a Sails controller action that retrieves reservations using a URL parameter for a reservation ID without validating ownership:

module.exports = {
  getReservation: async function (req, res) {
    const id = req.param('id');
    const reservation = await Reservation.findOne(id);
    return res.ok(reservation);
  }
};

An attacker can change the id to access another user’s reservation. Because CockroachDB supports distributed SQL with strong consistency, the query will succeed and return data, exposing a BOLA (Broken Object Level Authorization) issue. This is a Beast Attack pattern where the binding between the authenticated user and the data object is missing or incorrectly implemented.

In more complex scenarios, Sails policies or custom logic might attempt to scope queries using session data or JWT claims. If these claims are not validated against the database record ownership at query time, the attack surface expands. For instance, using a service that builds queries without enforcing user_id equality allows an attacker to leverage ID manipulation to traverse the dataset.

OpenAPI specifications can inadvertently support this if path parameters are not correctly mapped to authorization checks. Without runtime validation tying the request context to the data layer, the API remains vulnerable despite using a robust database like CockroachDB.

Remediation focuses on explicitly binding the authenticated user to every data access operation. In Sails, this means ensuring that every query includes a user_id filter derived from the authenticated session or token claims, not from client-supplied parameters.

Instead of relying on implicit associations, construct queries that enforce ownership at the database level. For Waterline ORM, this means always including the user_id in the where clause:

module.exports = {
  getReservation: async function (req, res) {
    const id = req.param('id');
    const userId = req.me.id; // authenticated user from session
    const reservation = await Reservation.findOne({
      id: id,
      user_id: userId
    });
    if (!reservation) {
      return res.notFound();
    }
    return res.ok(reservation);
  }
};

For raw queries using the CockroachDB driver directly, use parameterized statements to avoid injection and ensure the user context is part of the SQL:

const cockroach = require('cockroachdb');
const client = new cockroach.Client({/* config */});

module.exports = {
  getReservationRaw: async function (req, res) {
    const id = req.param('id');
    const userId = req.me.id;
    const result = await client.query(`
      SELECT * FROM reservation WHERE id = $1 AND user_id = $2
    `, [id, userId]);
    if (result.rows.length === 0) {
      return res.notFound();
    }
    return res.ok(result.rows[0]);
  }
};

When using the Sails CLI or integrating with automation tools, ensure that policies enforce user binding before allowing controller actions to execute. A custom policy can verify that the resource’s user_id matches the authenticated user’s ID.

For applications using the middleBrick CLI to scan these endpoints, it can detect missing ownership checks in unauthenticated scans and highlight BOLA findings with remediation guidance, helping teams identify gaps before deployment.

Continuous monitoring through the middleBrick Pro plan can help ensure that new endpoints maintain these bindings over time, especially as APIs evolve. The GitHub Action can fail builds if a scan detects missing user_id scoping in relevant endpoints.