Container Escape in Nestjs

Container escape in Nestjs applications typically occurs through improper file system access, unsafe module imports, or misconfigured dependency injection. The most common attack vector involves leveraging Node.js's fs module to traverse outside the container's root filesystem, especially when combined with user-controlled input.

A classic Nestjs-specific scenario involves dynamic module imports. Consider this vulnerable pattern:

@Controller('files')
export class FileController {
  @Get(':filename')
  async getFile(@Param('filename') filename: string) {
    // Path traversal vulnerability
    return fs.readFileSync(`./uploads/${filename}`);
  }
}

The issue here is that Nestjs's dependency injection system makes it easy to inject file system access throughout the application. An attacker can exploit this by requesting ../../../etc/passwd, escaping the intended directory.

Another Nestjs-specific manifestation involves custom providers and the use of useFactory for dynamic configuration. If a factory function uses user input to construct file paths or resolve modules, it creates an escape vector:

@Module({
  providers: [
    {
      provide: 'CONFIG_PROVIDER',
      useFactory: (envService: EnvService) => {
        // Vulnerable: user input affects file resolution
        return require(`./config/${envService.get('CONFIG_TYPE')}.js`);
      },
      inject: [EnvService]
    }
  ]
})
export class ConfigModule {}

Nestjs's module system can also introduce escape risks through circular dependencies. When modules import each other in complex ways, it's possible to create execution paths that bypass security controls, especially when combined with dynamic imports or forwardRef usage.

Detecting container escape vulnerabilities in Nestjs requires both static analysis and runtime scanning. The middleBrick API security scanner specifically identifies Nestjs-related escape patterns through its black-box scanning approach.

middleBrick's scanner tests for Nestjs-specific vulnerabilities by examining how your application handles file paths, module imports, and dependency injection. It automatically detects:

• Path traversal attempts in Nestjs controllers using common escape sequences
• Unsafe dynamic imports in module configuration
• Misconfigured file upload handlers that allow directory traversal
• Exposed debug endpoints that reveal internal module structure
• Unsafe use of require() with user-controlled variables

The scanner runs 12 parallel security checks in 5–15 seconds without requiring credentials or installation. For Nestjs applications, it specifically tests authentication bypass scenarios where an attacker might exploit module loading mechanisms.

Using middleBrick's CLI for Nestjs scanning:

npm install -g middlebrick
middlebrick scan https://your-nestjs-app.com

The scanner provides a security score (A–F) with Nestjs-specific findings, including whether your application exposes any module metadata that could aid in escape attempts. It also checks for compliance with OWASP API Top 10 categories relevant to Nestjs applications.

For continuous monitoring, the middleBrick GitHub Action can be added to your Nestjs CI/CD pipeline:

- name: middleBrick Security Scan
  uses: middlebrick/middlebrick-action@v1
  with:
    url: ${{ secrets.API_URL }}
    fail-on-severity: high

This integration ensures that any container escape vulnerabilities introduced during development are caught before deployment.

Remediating container escape vulnerabilities in Nestjs requires a combination of secure coding practices and leveraging Nestjs's built-in features. The most effective approach is to implement strict input validation and use Nestjs's validation pipes.

First, implement path sanitization using Nestjs's PipeTransform:

import { PipeTransform, Injectable, ArgumentMetadata, BadRequestException } from '@nestjs/common';
import { extname, join } from 'path';

@Injectable()
export class SafePathPipe implements PipeTransform {
  transform(value: string, metadata: ArgumentMetadata) {
    if (!value || typeof value !== 'string') {
      throw new BadRequestException('Invalid path');
    }
    
    // Prevent directory traversal
    if (value.includes('..') || value.includes('~')) {
      throw new BadRequestException('Path traversal detected');
    }
    
    return value;
  }
}

Apply this pipe to controllers that handle file operations:

@Controller('files')
export class FileController {
  constructor(private readonly fileService: FileService) {}

  @Get(':filename')
  @UsePipes(new SafePathPipe())
  async getFile(@Param('filename') filename: string) {
    return this.fileService.getFile(filename);
  }
}

For module-level security, use Nestjs's forwardRef carefully and avoid dynamic imports with user input. Instead, use configuration validation:

import { validate } from 'class-validator';
import { Type } from 'class-transformer';

export class ConfigOptions {
  @IsString()
  @IsIn(['dev', 'prod', 'staging'])
  env: string;

  @IsString()
  @Matches(/^[a-zA-Z0-9_-]+$/) // Allow only safe characters
  configType: string;
}

@Module({
  providers: [
    {
      provide: 'CONFIG_PROVIDER',
      useFactory: (envService: EnvService) => {
        const options = new ConfigOptions();
        options.env = envService.get('NODE_ENV');
        options.configType = envService.get('CONFIG_TYPE');
        
        const errors = validateSync(options);
        if (errors.length > 0) {
          throw new BadRequestException('Invalid configuration');
        }
        
        return require(`./config/${options.configType}.js`);
      },
      inject: [EnvService]
    }
  ]
})
export class ConfigModule {}

Additionally, use Nestjs's @Injectable() scope control to prevent unintended module exposure. Set appropriate scopes for services that handle file operations:

@Injectable({ scope: Scope.REQUEST })
export class FileService {
  private readonly allowedPaths = new Set(['uploads', 'public']);
  
  async getFile(filename: string) {
    const safePath = join(__dirname, '../uploads', filename);
    // Additional validation can be added here
    return fs.readFileSync(safePath);
  }
}

For comprehensive protection, combine these code-level fixes with middleBrick's continuous monitoring to ensure new vulnerabilities aren't introduced as your Nestjs application evolves.