Cache Poisoning in Chi with Dynamodb

Cache poisoning in the context of a Chi web application backed by Amazon DynamoDB occurs when an attacker manipulates cached responses such that subsequent requests receive tampered data. Because Chi routes are often configured to cache upstream or in-process responses, and because DynamoDB is commonly used as a persistent data store, unsafe caching behavior can cause poisoned entries to persist across users and sessions.

One common scenario involves a Chi endpoint that accepts user-controlled query parameters (e.g., locale or tenantId) and uses those values as keys in DynamoDB via the AWS SDK. If the application caches the raw DynamoDB response keyed by the unvalidated parameter, an attacker can supply a malicious key that results in a cache entry being shared with other users. For example, a request to /api/profile?locale=../../../../etc/passwd might produce a cache hit or miss that stores a poisoned response under a normalized key, inadvertently exposing sensitive data or causing incorrect application behavior.

DynamoDB-specific characteristics can exacerbate the issue. Because DynamoDB does not enforce schema constraints by default, an attacker may supply unexpected attribute names or types that the application logic incorrectly trusts. If the Chi application deserializes DynamoDB items into loosely typed maps or structures and then places those values into a cache without normalization or validation, the poisoned data can persist. Additionally, misconfigured partition key usage—such as relying on user input directly as a key without normalization—can lead to collisions where one user’s data is served under another user’s key, effectively a confused deputy pattern facilitated by the cache layer.

SSRF considerations also intersect here: if DynamoDB endpoint URLs or IAM metadata are exposed through error messages or misconfigured responses, an attacker might leverage cache poisoning to amplify reachability. Because middleBrick scans test input validation and SSRF in parallel, it can surface these interactions in the findings, highlighting how cache poisoning combined with DynamoDB misconfigurations increases risk.

To mitigate cache poisoning when using Chi with DynamoDB, validate and sanitize all inputs before using them as cache keys or DynamoDB keys. Avoid directly using user input as DynamoDB partition or sort keys; instead, map inputs to internal identifiers and enforce strict type constraints.

Example: Safe DynamoDB key construction and caching in Chi

// chi-dynamodb-safe.lisp
(ql:quickload '(:cl-json :drakma :usocket :ironclad))

(defun safe-tenant-key (raw-tenant-id)
  "Normalize tenant input to a safe DynamoDB key."
  (let ((normalized (string-trim " ./":(@[\\]" raw-tenant-id)))
        (prefix "tenant#"))
    (if (and (plusp (length normalized))
             (<= (length normalized) 32)
             (every (lambda (c) (find c "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.")) normalized))
        (concatenate 'string prefix normalized)
        (error "Invalid tenant identifier"))))

(defun get-profile-from-dynamo (tenant-id user-id)
  (let ((safe-tenant (safe-tenant-key tenant-id))
        (dynamodb-client (make-instance 'aws-sdk:dynamodb-client :region "us-east-1")))
    (aws-sdk:dynamodb-get-item
     dynamodb-client
     :table-name "UserProfiles"
     :key (cl-json:encode-json-to-string
           `((pk . ,(format nil "PROFILE#~A" safe-tenant))
             (sk . ,(format nil "USER#~A" user-id)))))))

;; Chi route with safe caching
(import '(:cheshire :cl-who) :shadowing-import-from (:cheshire :encode-json) :export-nothing)

(define-easy-handler (profile-handler :uri "/profile") (req)
  (let* ((tenant-id (get-parameter req "tenantId"))
         (user-id (get-parameter req "userId"))
         (cache-key (format nil "profile:~A:~A" (safe-tenant-key tenant-id) user-id))
         (cached (get-cached-response cache-key)))
    (if cached
        (progn (setf (response-header* :x-cache) "HIT")
               cached)
        (let ((profile (get-profile-from-dynamo tenant-id user-id)))
          (setf (response-header* :x-cache) "MISS")
          (set-cached-response cache-key profile :ttl 300)
          profile))))

Key remediation practices

• Input validation: Enforce allowlists on identifiers used for DynamoDB keys; reject unexpected characters and length violations.
• Key separation: Prefix keys with a namespace and avoid direct exposure of user input in cache keys; use internal IDs instead.
• Deserialization discipline: Prefer strongly typed structures over generic maps when converting DynamoDB items; avoid automatically trusting attribute names or values.
• Cache isolation: Ensure cache entries are scoped per user and tenant; do not share cache keys across tenants without strict isolation.
• Error handling: Do not expose DynamoDB error details or stack traces in responses; generic messages prevent information leakage that could aid poisoning.

By combining strict input validation, namespaced key construction, and disciplined caching, the risk of cache poisoning in Chi applications backed by DynamoDB is substantially reduced. middleBrick can validate these patterns by checking input validation and SSRF controls, ensuring your caching and data access logic remains robust.