Dangling Dns in Feathersjs (Javascript)

Dangling DNS occurs when a subdomain or CNAME record points to a service that no longer exists, such as a decommissioned cloud resource, SaaS application, or third-party API. In a FeathersJS application built with JavaScript, this vulnerability can expose internal services or enable subdomain takeover if the dangling DNS record is controllable by an attacker. FeathersJS applications often expose real-time APIs via Socket.IO or REST endpoints on subdomains (e.g., api.example.com, ws.example.com). If a development or staging subdomain like staging-api.example.com was previously pointing to a managed service (e.g., an AWS Elastic Beanstalk environment, Heroku app, or Firebase instance) that was later deleted without cleaning up the DNS record, an attacker could claim that dangling resource and serve malicious content under your domain.

This risk is amplified in FeathersJS due to its common use of environment-based configuration. Developers frequently define different API endpoints for development, staging, and production environments using environment variables. For example, a FeathersJS service might dynamically set its host based on process.env.FEATHERS_HOST. If the DNS for staging-api.example.com is dangling and an attacker takes over the underlying cloud resource, they can intercept or manipulate traffic intended for your staging API — potentially capturing authentication tokens, injecting malicious responses, or probing for internal endpoints.

Furthermore, FeathersJS’s plugin architecture and service middleware mean that misconfigured or orphaned services (e.g., a disabled authentication service) combined with dangling DNS can lead to unintended exposure. An attacker controlling the dangling domain could mimic your API’s behavior, tricking users or systems into sending sensitive data to an attacker-controlled endpoint that appears legitimate due to the valid DNS record.

While middleBrick cannot fix DNS configurations, it can detect the security implications of dangling DNS by identifying exposed APIs, unexpected data leakage, or anomalous behavior on scanned endpoints. In the context of a FeathersJS JavaScript application, remediation focuses on reducing the attack surface and ensuring that services only respond to intended, verified hosts. The following code examples demonstrate how to enforce host validation in a FeathersJS service using built-in hooks and middleware.

Implement a custom hook to validate the Host header against a list of allowed domains. This prevents the service from processing requests sent to dangling or malicious domains, even if the DNS resolves to your IP.

// src/hooks/validate-host.js
const allowedHosts = [
  'api.example.com',
  'staging-api.example.com',
  'ws.example.com'
];

module.exports = function () {
  return async function (context) {
    const { req } = context.params;
    const host = req.get('Host');
    if (!allowedHosts.includes(host)) {
      throw new Error(`Invalid host: ${host}`);
    }
    return context;
  };
};

Register this hook globally or on specific services to ensure all incoming requests are validated:

// src/hooks/index.js
const validateHost = require('./validate-host');

module.exports = {
  before: {
    all: [ validateHost() ],
    find: [],
    get: [],
    create: [],
    update: [],
    patch: [],
    remove: []
  },
  after: { ... },
  error: { ... }
};

Additionally, use environment-specific configuration to avoid hardcoding hosts. Load allowed hosts from environment variables to prevent misconfiguration across environments:

// src/config/hosts.js
module.exports = {
  allowedHosts: process.env.ALLOWED_HOSTS
    ? process.env.ALLOWED_HOSTS.split(',')
    : ['localhost', '127.0.0.1']
};

Then reference it in your hook:

// src/hooks/validate-host.js
const { allowedHosts } = require('../../config/hosts');

module.exports = function () {
  return async function (context) {
    const host = context.params.req.get('Host');
    if (!allowedHosts.includes(host)) {
      throw new Error(`Invalid host: ${host}`);
    }
    return context;
  };
};

These JavaScript-specific controls in FeathersJS ensure that even if a dangling DNS record points to your server, the application will reject requests from unauthorized hosts. Combine this with regular DNS audits and infrastructure-as-code checks to fully mitigate the risk. middleBrick can help by scanning your exposed FeathersJS endpoints and flagging unexpected behavior, such as data exposure or authentication bypass, that may indicate a dangling DNS is being abused.