Container Escape in Rocket with Cockroachdb

A container escape in a Rocket application using CockroachDB typically occurs when the application or its dependencies allow an attacker to break out of the container’s isolated environment and interact with the host or other containers. This risk is heightened when the application dynamically constructs database connection strings, mounts CockroachDB volumes with broad permissions, or exposes administrative endpoints without proper authentication.

Rocket applications that embed CockroachDB client configurations via environment variables can inadvertently expose sensitive connection parameters. If an attacker gains the ability to inject environment variables or manipulate configuration at runtime, they may redirect CockroachDB connections to a malicious listener, exfiltrate credentials, or probe internal network services that would otherwise be unreachable from the container.

The combination of Rocket’s runtime and CockroachDB’s network-exposed SQL interface can amplify risks if input validation is weak. For example, user-controlled data used to build SQL queries without sufficient sanitization may enable SSRF or command injection when those queries are passed to administrative tooling or backup scripts that interact with the CockroachDB binary. Such paths can facilitate container escape by leveraging CockroachDB’s external connectivity to reach host-level resources.

Additionally, if the container runs with elevated privileges or mounts the host filesystem (e.g., for CockroachDB data directories), a vulnerability in Rocket’s request handling could allow file writes to sensitive host paths. An attacker might exploit this to overwrite binary components or inject malicious startup scripts that execute on the host when the container restarts, effectively breaking containment.

middleBrick can detect risk patterns related to unauthenticated endpoints, input validation weaknesses, and unsafe consumption practices that may contribute to container escape scenarios. By scanning the API surface, including OpenAPI specs that reference CockroachDB administration routes or configuration endpoints, the tool highlights findings that could enable lateral movement or privilege escalation across container boundaries.

Remediation focuses on strict input validation, avoiding dynamic construction of sensitive configuration, and enforcing least-privilege execution. Below are concrete code examples for a Rocket application connecting to CockroachDB securely.

First, define a configuration structure that reads static connection parameters from environment variables without runtime mutation. Use strongly typed Rocket managed state to ensure the database handle is initialized safely:

#[macro_use] extern crate rocket;

use rocket_db_pools::Connection;
use cockroach_client::CockroachConnectionManager;

#[database("cockroach")]
struct DbConn(Connection);

#[launch]
fn rocket() -> _ {
    rocket::build()
        .manage(CockroachConnectionManager::new(
            "host=cockroachdb.example.com port=26257 user=app_user password=** dbname=app_db sslmode=require"
        ))
        .attach(DbConn::init())
        .mount("/", routes![health])
}

Second, ensure that any SQL execution paths avoid concatenating user input directly into queries. Use parameterized queries to prevent injection that could be leveraged for container escape:

use rocket::serde::json::Json;
use crate::DbConn;

#[get("/user/")]
async fn get_user(db: &DbConn, id: i32) -> Json<User> {
    let user = db.query_one(
        "SELECT id, name FROM users WHERE id = $1",
        &[&id]
    ).await.expect("Failed to fetch user");
    Json(user)
}

Third, restrict filesystem access and avoid mounting CockroachDB data directories with write permissions for the application user. If backups are required, invoke CockroachDB client tools via a controlled, non-interactive process with predefined arguments:

use std::process::Command;

fn run_backup() -> std::io::Result<()> {
    Command::new("/cockroach/cockroach")
        .args(["sql", "--certs-dir=/certs", "--execute=BACKUP TO 's3://backup-bucket'"])
        .status()?;
    Ok(())
}

Finally, apply network policies to limit CockroachDB traffic to known services only. In your deployment configuration, define ingress rules that restrict source IPs and disable unused administrative ports. This reduces the attack surface that a container escape could exploit to reach CockroachDB instances in other namespaces.