Container Escape in Sails with Cockroachdb

A container escape in a Sails application using CockroachDB typically occurs when an attacker who has compromised the application runtime leverages misconfigured process privileges, volume mounts, or network exposures to break out of the container and interact with the host or other containers. In this stack, Sails provides the Node.js web framework surface, CockroachDB supplies the distributed SQL database, and the container runtime (e.g., Docker) enforces isolation boundaries.

The risk materializes when Sails services are containerized with overly permissive capabilities (e.g., --cap-add=SYS_ADMIN), bind-mount host paths into the container without read-only restrictions, or expose the database driver or diagnostic endpoints to untrusted networks. CockroachDB’s client drivers, when misconfigured in Sails models or services, may open unexpected network channels or allow command-like options that, if combined with a shell in the container, enable lateral movement or host interference. An attacker might exploit insecure model configurations, such as raw query endpoints or poorly sandhooked lifecycle callbacks, to execute commands that interact with mounted filesystems or probe other containers.

For example, if a Sails controller deserializes untrusted input into a raw Knex or CockroachDB query without strict validation, and the container runs with extended capabilities or host PID access, an attacker can chain injection into container-level actions. This could include reading sensitive host files via mounted volumes, invoking host binaries, or abusing shared namespaces. The 12 security checks in middleBrick, including Input Validation and Unsafe Consumption, are designed to detect such risky configurations and patterns in unauthenticated scans, highlighting how an unauthenticated attack surface may expose this combination to privilege escalation or data exposure.

Using middleBrick’s scans, teams can identify insecure deployment practices for Sails + CockroachDB containers, such as missing resource limits, permissive network policies, or lack of read-only root filesystems, which are common precursors to container escapes. The scanner’s checks on Authentication, BOLA/IDOR, and Property Authorization, combined with its specific Input Validation and Unsafe Consumption tests, help surface the conditions that facilitate container escape in this specific stack.

Remediation centers on strict input validation, least-privilege container settings, and secure usage of CockroachDB from Sails models. Ensure your container drops all unnecessary Linux capabilities, does not mount sensitive host paths, and runs with read-only filesystems where possible.

• Use parameterized queries with the CockroachDB Node.js driver to avoid injection points that could be chained to container-level actions.
• Apply principle of least privilege to the database user and to the container runtime, avoiding host PID or network namespace sharing unless strictly required.
• Sanitize and validate all inputs that reach Sails models or lifecycle callbacks before they are used in database operations.

Example secure Sails model using CockroachDB with parameterization and strict input checks:

// api/models/Account.js
module.exports = {
  attributes: {
    username: { type: 'string', required: true, unique: true },
    email: { type: 'string', required: true },
    role: { type: 'string', defaultsTo: 'user' },
    // No raw query strings from user input
  },

  // Safe service method using the CockroachDB adapter with parameters
  findSafeByEmail: async function(email) {
    const escapedEmail = this._escapeEmail(email);
    // Using a parameterized query via the underlying adapter
    const result = await sails.getDatastore().sendNativeQuery(
      'SELECT id, username, role FROM accounts WHERE email = $1',
      [escapedEmail]
    );
    return result.rows;
  },

  _escapeEmail: function(email) {
    // Basic validation and escaping; rely on parameterized queries primarily
    if (typeof email !== 'string' || !email.includes('@')) {
      throw new Error('Invalid email format');
    }
    return email.trim();
  }
};

Example controller ensuring strict validation before invoking the model:

// api/controllers/AccountController.js
module.exports = {
  getUserByEmail: async function(req, res) {
    const email = req.param('email');
    if (!email || !/.+@.\w+\.\w+/.test(email)) {
      return res.badRequest('Invalid email parameter');
    }
    try {
      const user = await Account.findSafeByEmail(email);
      if (!user || user.length === 0) {
        return res.notFound();
      }
      // Return only safe fields
      return res.ok({ username: user[0].username, role: user[0].role });
    } catch (err) {
      sails.log.error('Database query error:', err);
      return res.serverError('Unable to fetch user');
    }
  }
};

In your container configuration, ensure resource limits and security options are set, and avoid exposing database diagnostic endpoints to public networks. middleBrick’s checks on Input Validation, Property Authorization, and Unsafe Consumption can highlight insecure patterns in your Sails models and help prevent conditions that could facilitate container escape when combined with CockroachDB connectivity.