Cache Poisoning in Fiber with Dynamodb

Cache poisoning in a Fiber application that uses DynamoDB as a persistence layer typically occurs when user-supplied or unvalidated input influences cache keys, cache values, or cache-control behavior, leading to unintended data being served or stored. This combination becomes risky because DynamoDB does not enforce schema-level constraints on attribute values beyond basic type checks, allowing an attacker to inject malformed or malicious data that can propagate through cached representations.

In a typical Fiber route, developers may cache DynamoDB query results to reduce latency. If the cache key is derived directly from request parameters without normalization or strict validation, an attacker can vary a parameter such as userId or resourceId to cause cache collisions. For example, supplying a key that includes newline or control characters can lead to key confusion in some caching layers, causing one user’s cached data to be served to another. Even when the cache layer itself is neutral, the application logic that builds the key must be trusted; if it is not, an attacker can manipulate what is stored and retrieved.

DynamoDB-specific aspects exacerbate the issue. Since DynamoDB stores items as loosely typed attribute maps, an attacker can supply nested structures or large strings that bloat cached payloads, increasing memory pressure and potentially evicting legitimate entries. More critically, if query expressions or scan filters are built by concatenating strings rather than using parameterized expressions, an attacker may inject attribute names or values that alter the semantics of the query. This can result in reading other users’ data under the same cache key due to inconsistent filtering, a variant of Broken Access Control (BOLA/IDOR). The unauthenticated attack surface that middleBrick tests—including input validation and BOLA/IDOR—can surface these weaknesses by probing endpoints that rely on DynamoDB queries without proper authorization checks on cached paths.

Another angle is response manipulation via malicious item content. If a DynamoDB item contains fields such as contentType or rawHtml that are directly rendered or cached without escaping, an attacker can store script payloads or malformed headers that lead to stored XSS or cache-based information disclosure. Because middleBrick’s checks include Data Exposure and Input Validation, it can identify endpoints where untrusted data from DynamoDB reaches the response without encoding or schema enforcement. LLM/AI Security checks may further highlight cases where model-generated code inadvertently introduces unsafe concatenation patterns when building cache keys or values.

Remediation focuses on strict input validation, canonical cache-key construction, and safe DynamoDB interactions in Fiber handlers. Avoid deriving cache keys directly from raw query parameters or headers. Instead, normalize inputs, apply allowlists, and use a deterministic key format. For DynamoDB, prefer parameterized expressions over string concatenation, and enforce schema validation on retrieved items before caching.

Example: Safe cache-key building and DynamoDB getItem

import { Router } from 'express';
import { DynamoDBClient, GetItemCommand } from '@aws-sdk/client-dynamodb';
import { unmarshall } from '@aws-sdk/util-dynamodb';
import { createCacheKey } from './utils';

const router = Router();
const ddb = new DynamoDBClient({ region: 'us-east-1' });

router.get('/items/:id', async (req, res) => {
  // Strict validation: allow only alphanumeric IDs
  const id = req.params.id;
  if (!/^[a-zA-Z0-9_-]{1,64}$/.test(id)) {
    return res.status(400).send('Invalid item ID');
  }

  const cacheKey = createCacheKey('item-v1', { id });
  const cmd = new GetItemCommand({
    TableName: process.env.TABLE_NAME,
    Key: { id: { S: id } },
  });

  const { Item } = await ddb.send(cmd);
  if (!Item) {
    return res.status(404).send('Not found');
  }

  const item = unmarshall(Item);
  // Validate schema of the retrieved item before caching
  if (typeof item.contentType !== 'string' || !['text', 'json'].includes(item.contentType)) {
    return res.status(400).send('Invalid content type');
  }

  res.set('Cache-Control', 'public, max-age=300');
  res.json(item);
});

Example: Parameterized query with ExpressionAttributeValues

import { DynamoDBClient, QueryCommand } from '@aws-sdk/client-dynamodb';
import { marshall } from '@aws-sdk/util-dynamodb';

const ddb = new DynamoDBClient({ region: 'us-east-1' });

export async function searchUserItems(userId: string, category: string) {
  // Parameterized expression prevents injection into query structure
  const cmd = new QueryCommand({
    TableName: process.env.TABLE_NAME,
    IndexName: 'gsi-category',
    KeyConditionExpression: 'userId = :uid AND category = :cat',
    ExpressionAttributeValues: marshall({ ':uid': userId, ':cat': category }),
    Limit: 50,
  });

  const { Items } = await ddb.send(cmd);
  return Items?.map(unmarshall) ?? [];
}

In a CI/CD pipeline, adding the GitHub Action from middleBrick can enforce a security score threshold before deployment, ensuring that endpoints using DynamoDB are continuously monitored for cache-related risks. The CLI can be used locally to scan endpoints during development: middlebrick scan <url>. For proactive protection, enable continuous monitoring in the Pro plan so that changes to DynamoDB-accessing routes trigger re-scans and alerts if new parameter handling introduces unsafe cache behavior.