Arp Spoofing on Netlify

Arp Spoofing in Netlify environments typically occurs through compromised build processes or misconfigured serverless functions that expose internal network information. Unlike traditional network-based ARP spoofing, Netlify-specific manifestations focus on build-time vulnerabilities and runtime function exposures.

During the build phase, malicious packages in your dependencies can execute ARP-related network discovery code. This is particularly dangerous in Netlify's containerized build environment where build scripts have network access. Attackers may target package.json files to inject dependencies that perform network reconnaissance during npm install or yarn install.

Runtime Arp Spoofing manifests when serverless functions inadvertently expose internal network interfaces or when functions make unauthorized network requests that could be intercepted. Netlify Functions run in isolated containers, but misconfigured CORS settings or overly permissive function permissions can create attack vectors.

// Vulnerable Netlify function exposing network info
exports.handler = async (event, context) => {
  const os = require('os');
  const networkInterfaces = os.networkInterfaces();
  
  // This exposes internal network details
  return {
    statusCode: 200,
    body: JSON.stringify(networkInterfaces)
  };
};

The above function demonstrates a common Netlify-specific vulnerability where serverless functions expose operating system network information that could be used for ARP spoofing reconnaissance.

Another manifestation occurs through build plugins. Netlify Build Plugins run with elevated privileges during the build process and can execute arbitrary code. A malicious plugin could perform ARP scanning during the build phase:

// Malicious build plugin example
const arp = require('node-arp');

module.exports = {
  onPreBuild: async ({ netlifyConfig }) => {
    // Scan local network during build
    arp.getMAC('192.168.1.1', (err, mac) => {
      console.log('Discovered MAC:', mac);
    });
  }
};

Netlify's dependency management system can also be a vector. If your build process downloads packages from untrusted registries or uses compromised package versions, malicious code could execute ARP discovery during the build phase.

Detecting Arp Spoofing in Netlify requires a multi-layered approach combining build-time scanning and runtime monitoring. middleBrick's API security scanner can identify Netlify-specific vulnerabilities through its comprehensive scanning methodology.

For build-time detection, middleBrick scans your package.json and build configuration files for suspicious dependencies and scripts. The scanner looks for packages commonly associated with network reconnaissance and ARP scanning:

# middleBrick CLI scan for Netlify project
middlebrick scan https://your-netlify-site.com --type=api

# Or scan your GitHub repository directly
middlebrick scan https://github.com/your-org/your-repo

middleBrick's detection engine specifically identifies Netlify Function vulnerabilities by analyzing your functions directory structure and examining function code for network exposure patterns. The scanner tests for:

• Exposed network interface information
• Overly permissive CORS configurations
• Functions that make unauthorized network requests
• Build plugins with suspicious network capabilities
• Dependencies with known network reconnaissance capabilities

The scanner also examines your Netlify configuration files (netlify.toml) for security misconfigurations that could enable ARP spoofing attacks. This includes checking function permissions, build environment variables, and redirect rules.

Runtime detection through middleBrick involves active scanning of your deployed Netlify Functions. The scanner tests each function endpoint for network information exposure and attempts to trigger any ARP-related functionality that might be present in your codebase.

For continuous monitoring, middleBrick's Pro plan offers scheduled scans that can detect new vulnerabilities introduced through dependency updates or code changes. This is particularly important for Netlify sites where automated deployments might introduce new attack vectors without manual review.

Remediating Arp Spoofing vulnerabilities in Netlify requires both build-time and runtime security measures. Start with dependency management and build process hardening.

Implement strict dependency verification in your package.json:

{
  "name": "your-netlify-app",
  "dependencies": {
    "express": "^4.18.2",
    "axios": "^1.6.0"
  },
  "audit": true,
  "resolutions": {
    "node-arp": "npm:[email protected]"
  }
}

Configure your Netlify build settings to prevent unauthorized network access:

# netlify.toml
[build]
  command = "npm run build"
  publish = "dist"

[build.environment]
  # Restrict network access during build
  NODE_OPTIONS = "--max-http-header-size=8192"
  
# Function configuration
[functions]
  # Limit function runtime and memory
  node_bundler = "esbuild"
  external_node_modules = ["node-arp", "network", "os"]
  
# Security headers
[[headers]]
  for = "/*"
  [headers.values]
    X-Frame-Options = "DENY"
    X-Content-Type-Options = "nosniff"
    Referrer-Policy = "strict-origin-when-cross-origin"

Secure your Netlify Functions by implementing proper input validation and network restrictions:

// Secure Netlify function example
const { URL } = require('url');

exports.handler = async (event, context) => {
  // Validate request origin
  const origin = event.headers.origin || '';
  const allowedOrigins = ['https://yourdomain.com'];
  
  if (!allowedOrigins.includes(origin)) {
    return {
      statusCode: 403,
      body: JSON.stringify({ error: 'Forbidden' })
    };
  }

  // Sanitize any network-related inputs
  const query = event.queryStringParameters || {};
  if (query.ip) {
    const ip = query.ip.trim();
    // Basic IP validation
    if (!/^(\d{1,3}\.){3}\d{1,3}$/.test(ip)) {
      return {
        statusCode: 400,
        body: JSON.stringify({ error: 'Invalid IP format' })
      };
    }
  }

  return {
    statusCode: 200,
    body: JSON.stringify({ message: 'Secure response' })
  };
};

Implement runtime security monitoring using Netlify's built-in features:

# Add security checks to your build process
# package.json scripts
{
  "scripts": {
    "build": "npm run security-check && npm run compile",
    "security-check": "npm audit --audit-level=moderate && middlebrick scan ./functions"
  }
}

For comprehensive protection, integrate middleBrick's continuous monitoring into your Netlify deployment pipeline using the GitHub Action:

# .github/workflows/security.yml
name: Security Scan
on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run middleBrick Scan
        uses: middlebrick/middlebrick-action@v1
        with:
          api_url: https://your-netlify-site.com
          fail_below_score: B
          github_token: ${{ secrets.GITHUB_TOKEN }}