Dangling Dns in Echo Go with Api Keys

A dangling DNS record occurs when a hostname remains in DNS but no service is actively listening at that address. In an Echo Go service that relies on API keys for access control, this combination can expose internal or deprecated endpoints to unintended network paths. When an API key is validated before routing, the application may assume the target host is authoritative and reachable. If the DNS entry for the expected host has become stale—pointing to a decommissioned server, an incorrect CNAME, or a wildcard that resolves unpredictably—the request may be forwarded to an unintended location. An attacker who can influence or observe the resolution path might intercept or manipulate traffic that appears authenticated due to the presence of a valid API key.

Echo Go typically uses middleware to extract and verify API keys from headers before proceeding with request handling. If the downstream host used for routing or logging is resolved via DNS at service startup or per-request, and that DNS record later becomes inconsistent, the validated request may be sent to a host that does not enforce the same security policies. For example, a hostname like legacy.internal.example.com might have previously pointed to a secure internal service that enforced both API key validation and network-level isolation. If that record now resolves to a different host—perhaps one that only checks the API key but lacks internal network segmentation—an attacker with network position advantages could exploit the mismatch. The API key appears to grant access, but the underlying endpoint may be less restricted or even entirely unrelated to the intended service, leading to data exposure or unauthorized operations.

This scenario is particularly relevant when API keys are used as the primary authorization mechanism without additional context checks, such as strict hostname validation or mutual TLS. The Echo Go application may log or trace requests using the resolved IP or hostname, and if that information is trusted implicitly, it can lead to incorrect auditing or alerting. In a black-box scan, middleBrick tests such configurations by probing endpoints with valid API keys while monitoring DNS resolution paths and responses. Findings can highlight mismatches between declared routing logic and actual DNS behavior, which may align with checks such as BOLA/IDOR or Property Authorization when access controls depend on host identity.

Remediation focuses on ensuring that API key validation is tightly coupled with verified endpoint identity and that DNS resolution is treated as an untrusted input. The following examples demonstrate secure patterns in Echo Go.

1. Pin hostnames and avoid runtime DNS for routing decisions

Instead of resolving a hostname on each request, resolve once at startup and verify it matches an expected value. Use IP addresses or explicit host headers for outbound calls.

// Safe: resolve once and compare against an allowlist
package main

import (
	"net"
	"net/http"

	"github.com/labstack/echo/v4"
)

var allowedHostIP string

func init() {
	// Replace with the expected internal IP or hostname
	expected := "legacy.internal.example.com"
	ip, err := net.ResolveIPAddr("ip", expected)
	if err != nil {
		panic("failed to resolve expected host: " + err.Error())
	}
	allowedHostIP = ip.String()
}

func ValidateHost(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		// Assume we have an API key header validated earlier
		// Perform an outbound request to a pinned host
		req, _ := http.NewRequest(c.Request().Method, "https://"+allowedHostIP+"/resource", nil)
		req.Header.Set("Authorization", "Bearer "c.Request().Header.Get("X-API-Key"))
		resp, err := http.DefaultClient.Do(req)
		if err != nil || resp.StatusCode != http.StatusOK {
			return c.String(http.StatusInternalServerError, "upstream validation failed")
		}
		return next(c)
	}
}

2. Enforce hostname whitelisting in HTTP transport

Configure a custom Transport that validates the request’s host against a known list, preventing redirection or unexpected routing due to DNS changes.

// Host verification transport
package main

import (
	"crypto/tls"
	"net/http"
	"strings"

	"github.com/labstack/echo/v4"
)

func NewVerifiedTransport(allowedHosts []string) *http.Transport {
	return &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: false,
		},
		Proxy: http.ProxyURL(nil),
		DialContext: (&net.Dialer{
			Timeout:   30,
		}).DialContext,
		// Optional: verify that the resolved host matches allowed list
		ForceAttemptHTTP2: false,
		// You can wrap RoundTripper to add hostname checks if needed
	}
}

func main() {
	e := echo.New()
	transport := NewVerifiedTransport([]string{"legacy.internal.example.com"})
	client := &http.Client{Transport: transport}

	// Example route that uses API key and a pinned client
	e.GET("/proxy", func(c echo.Context) error {
		apiKey := c.Request().Header.Get("X-API-Key")
		if apiKey == "" {
			return c.String(http.StatusUnauthorized, "missing key")
		}
		req, _ := http.NewRequest("GET", "https://legacy.internal.example.com/data", nil)
		req.Header.Set("X-API-Key", apiKey)
		resp, err := client.Do(req)
		if err != nil || resp.StatusCode != http.StatusOK {
			return c.String(http.StatusBadGateway, "upstream error")
		}
		defer resp.Body.Close()
		return c.JSONBlob(resp.StatusCode, resp.Body)
	})

	e.Logger.Fatal(e.Start(":8080"))
}

3. Treat DNS and API key validation as independent checks

Do not assume a valid API key implies a trusted network origin. Log both the resolved host and the API key status separately, and apply defense-in-depth by restricting outbound connections to known IP ranges.

// Example structured logging for audit trails
package main

import (
	"log"
	"net"

	"github.com/labstack/echo/v4"
)

func AuditMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		apiKey := c.Request().Header.Get("X-API-Key")
		remoteIP, _, _ := net.SplitHostPort(c.Request().RemoteAddr)
		host, _ := net.LookupHost(c.Request().Host)
		log.Printf("key_status=unknown resolved_hosts=%v remote_ip=%s", host, remoteIP)
		// Continue validation
		return next(c)
	}
}