Container Escape in Adonisjs with Cockroachdb

A container escape in an AdonisJS application using CockroachDB occurs when a process running inside a container gains the ability to interact with the host system or other containers. This typically is not a flaw in CockroachDB itself, but rather a result of how AdonisJS interacts with the database, combined with container runtime misconfigurations.

AdonisJS, a Node.js web framework, may use CockroachDB as a persistence layer. If the application processes untrusted input and passes it to database queries without adequate validation, an attacker can attempt SQL injection or command injection. Successful injection could enable execution of operating system commands via database functions or external procedures, which, when combined with a container that has elevated privileges or shared namespaces, may allow an attacker to break out of the container boundary.

For example, if AdonisJS uses raw queries with user-controlled data to call CockroachDB extensions or functions that execute shell commands (such as external UDFs or improperly secured stored procedures), and the container is running as root or has access to the host’s Docker socket, the injected command may execute on the host. This can lead to container escape, where the attacker moves from the isolated application environment to the host or other containers.

Another vector involves volume mounts. If the AdonisJS application running in a container mounts sensitive host paths (e.g., /var/run/docker.sock or /proc) into the container, and CockroachDB credentials or connection strings are exposed through the application’s configuration or logs, an attacker can leverage the mounted socket to spawn containers with the same privileges, effectively escaping the original container’s isolation.

The risk is further influenced by the default configurations often used in development or quick-start deployments. For instance, running CockroachDB client instances without explicit user permissions, or using the framework’s CLI commands that execute system-level operations, can amplify the impact of a successful injection. middleBrick scans for such unauthenticated attack surfaces in frameworks like AdonisJS, identifying risky patterns in how database operations are constructed and executed.

Remediation focuses on preventing injection vectors and ensuring containers run with least privilege. Always use parameterized queries or the query builder in AdonisJS instead of raw SQL, especially when interacting with CockroachDB.

Parameterized Query Example

import { BaseModel } from '@ioc:Adonis/Lucid/Orm'
import { DateTime } from 'luxon'

export default class User extends BaseModel {
  public static async findByEmail(email: string) {
    // Safe: using parameterized query builder
    const user = await this.query()
      .where('email', email)
      .preload('roles')
      .first()
    return user
  }
}

Raw Query with Bind Parameters (if necessary)

import { DbClientContract } from '@ioc:Adonis/Lucid/Database'

export async function getUserOrders(db: DbClientContract, userId: number) {
  // Safe: using ? placeholders and bindings
  const orders = await db.queryRaw(
    'SELECT * FROM orders WHERE user_id = $1',
    [userId]
  )
  return orders.rows
}

Avoiding Dangerous Functions and Volume Mounts

• Do not mount /var/run/docker.sock or other host system paths into the AdonisJS container unless absolutely necessary. If required, use read-only mounts and restrict container capabilities.
• Ensure CockroachDB connections use least-privilege database users. For example, create a dedicated user with only the required permissions:

-- CockroachDB SQL example to create a limited-privilege user
CREATE USER adonis_app WITH PASSWORD 'strong_password';
GRANT SELECT, INSERT, UPDATE ON TABLE users TO adonis_app;
-- Do not grant superuser or DDL privileges to the application user

Environment and Configuration Hardening

• Set the Node environment to production and disable debugging features that might expose stack traces or internal paths.
• Validate and sanitize all inputs that could reach database queries, even when using an ORM.
• Use secrets management for database credentials and avoid embedding them in the source code or Docker images.

By combining secure coding patterns in AdonisJS with restricted container configurations, the attack surface for container escape is significantly reduced. middleBrick’s checks include runtime analysis against such misconfigurations and highlights findings mapped to frameworks like OWASP API Top 10 to guide remediation.