Dangling Dns in Gorilla Mux with Cockroachdb

A dangling DNS configuration in a Gorilla Mux service that uses CockroachDB can expose connection logic and internal hostnames during request handling. When routes defined in mux use dynamic host resolution for the database—such as reading a hostname from an environment variable or a configuration map that does not enforce strict DNS records—clients or attackers can supply crafted inputs that redirect connections to unintended endpoints.

Gorilla Mux does not inherently validate or sanitize variables used to construct data source names (DSNs). If a route parameter or query value is interpolated into a CockroachDB DSN without validation, an attacker can supply a hostname that resolves to an external or internal host not intended for the application. This may cause the application to open a connection to a rogue database server, effectively creating a dangling or misdirected DNS resolution path. Because CockroachDB often runs in distributed clusters with internal hostnames or private DNS zones, a misconfigured resolver can bypass network-level segregation and expose cluster-internal endpoints to the application layer.

During a middleBrick scan, this class of issue is surfaced under BFLA/Privilege Escalation and Property Authorization checks, because the API may allow runtime configuration of database targets. The scanner tests whether unauthenticated endpoints can influence database connection targets via path or query parameters. For example, an endpoint like /transfer?db_host=attacker-controlled.example.com could redirect CockroachDB traffic if the DSN is built naively from the request.

In such cases, the API may not enforce input validation on hostname parameters, and the lack of route-level authorization allows an attacker to probe alternate DNS resolutions. The scanner’s input validation and property authorization checks specifically test whether user-supplied data can affect infrastructure-level decisions like connection targets. Even without authentication, certain routes might be invoked, demonstrating that the unauthenticated attack surface includes logic that can redirect database traffic.

Because CockroachDB connections often rely on TLS and internal CA verification, a dangling DNS setup may still complete a handshake if certificates are broadly trusted, increasing the risk of data exfiltration or manipulation. The scanner’s encryption and data exposure checks look for circumstances where connections are established without adequate hostname verification, which can align with misconfigured DNS resolution patterns.

To mitigate dangling DNS in a Gorilla Mux service using CockroachDB, enforce strict input validation, avoid runtime DSN assembly from user-controlled values, and use fixed, verified connection parameters. The following examples illustrate secure patterns.

1. Fixed DSN with no user input

Define the CockroachDB DSN as a constant or from a secure configuration source, and do not allow route parameters or query strings to modify it.

// main.go
package main

import (
	"database/sql"
	"log"
	"net/http"
	"os"

	"github.com/gorilla/mux"
	_ "github.com/cockroachdb/cockroach-go/v2/crdb"
)

const cockroachDSN = "postgresql://root@localhost:26257/defaultdb?sslmode=verify-full&sslrootcert=certs/ca.pem"

func main() {
	db, err := sql.Open("cockroachdb", cockroachDSN)
	if err != nil {
		log.Fatalf("failed to connect: %v", err)
	}
	defer db.Close()

	router := mux.NewRouter()
	router.HandleFunc("/accounts/{id}", getAccountHandler(db)).Methods("GET")
	http.ListenAndServe(":8080", router)
}

func getAccountHandler(db *sql.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		vars := mux.Vars(r)
		id := vars["id"]
		// Use parameterized queries; do not build DSN from input
		var balance int
		err := db.QueryRowContext(r.Context(), "SELECT balance FROM accounts WHERE id = $1", id).Scan(&balance)
		if err != nil {
			http.Error(w, "not found", http.StatusNotFound)
			return
		}
		w.Write([]byte("balance: " + string(balance)))
	}
}

2. Validated configuration via environment with fallback

If you must read connection details from environment, validate against an allowlist or strict pattern and do not concatenate user input into the DSN.

// config.go
package main

import (
	"fmt"
	"net"
	"os"
	"regexp"
)

var hostAllowlist = map[string]bool{
	"cockroach-internal.default.svc.cluster.local": true,
}

func validatedDSN() (string, error) {
	host := os.Getenv("COCKROACH_HOST")
	if host == "" {
		host = "cockroach-internal.default.svc.cluster.local"
	}
	if !hostAllowlist[host] {
		return "", fmt.Errorf("invalid database host: %s", host)
	}
	// Ensure host resolves and is not a dangling name
	if _, err := net.LookupHost(host); err != nil {
		return "", fmt.Errorf("failed to resolve cockroach host: %w", err)
	}
	return fmt.Sprintf("postgresql://root@%s:26257/defaultdb?sslmode=verify-full&sslrootcert=certs/ca.pem", host), nil
}

3. Route isolation and no dynamic database selection

Do not create routes that select a database or host based on user input. If multi-tenant routing is required, map tenant identifiers to predefined connection pools initialized at startup, not constructed per request.

// tenant_handlers.go
package main

import (
"database/sql"
"net/http"
)

var tenantDBs = map[string]*sql.DB{
"tenant-a": initDB("postgresql://[email protected]:26257/tenant_a?sslmode=verify-full&sslrootcert=certs/ca.pem"),
"tenant-b": initDB("postgresql://[email protected]:26257/tenant_b?sslmode=verify-full&sslrootcert=certs/ca.pem"),
}

func initDB(dsn string) *sql.DB {
	db, err := sql.Open("cockroachdb", dsn)
	if err != nil {
		panic(err)
	}
	return db
}

func tenantHandler(tenantID string) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
	db, ok := tenantDBs[tenantID]
	if !ok {
		http.Error(w, "invalid tenant", http.StatusBadRequest)
		return
	}
	// Use db for queries; tenant mapping is fixed at initialization
	}
}

4. Enforce hostname verification for TLS

When using SSL, ensure the certificate verification includes proper hostname checking to prevent connections to unintended hosts even if DNS resolves.

// tls_config.go
package main

import (
	"crypto/tls"
	"crypto/x509"
	"os"
)

func secureTLSConfig() (*tls.Config, error) {
	caCert, err := os.ReadFile("certs/ca.pem")
	if err != nil {
		return nil, err
	}
	caCertPool := x509.NewCertPool()
	caCertPool.AppendCertsFromPEM(caCert)
	return &tls.Config{
		RootCAs: caCertPool,
		// Ensure ServerName is set explicitly for hostname verification
		ServerName: "cockroach-internal.default.svc.cluster.local",
	}, nil
}

By combining fixed DSNs, validated configuration, tenant isolation, and strict TLS verification, you eliminate the conditions that enable dangling DNS scenarios while preserving compatibility with CockroachDB’s distributed deployment patterns.