Insufficient Logging in Cockroachdb

Insufficient logging in CockroachDB typically appears when critical database operations are not recorded in the audit log or when the log level is too low to capture security‑relevant events. CockroachDB exposes an HTTP admin API (default port 8080) that accepts SQL statements, cluster‑setting changes, and node‑management commands. If audit logging is disabled, an attacker who gains access to this endpoint can execute privileged actions — such as creating new users, altering roles, or exporting data — without leaving a trace in crdb_internal.audit_events or the node logs.

Common attack patterns that exploit this gap include:

• Privilege escalation via role manipulation: An attacker sends a POST to /_admin/v1/sql with a body like {"statements":["CREATE ROLE attacker; GRANT admin TO attacker;"]}. Without audit logging, the creation of the role and the grant are invisible.
• Data exfiltration through SELECT … INTO: A malicious query such as SELECT * FROM users INTO '/tmp/users.csv' can be issued via the admin API. If the audit log does not capture the INTO clause, the exfiltration goes unnoticed.
• Cluster‑setting abuse: Changing sql.audit.enabled to false or adjusting log.file.max_size to a tiny value can be done through the HTTP endpoint, effectively silencing further logging.

These actions map to OWASP API8:2023 – Security Misconfiguration, where insufficient logging prevents detection of misuse. Real‑world incidents, such as the 2017 Equifax breach, showed that attackers remained undetected for weeks partly because critical database actions were not logged.

Detecting insufficient logging in a CockroachDB deployment involves verifying that audit logging is enabled and that the log level captures authentication, authorization, and data‑definition events. Since middleBrick scans exposed HTTP endpoints, it can be pointed at the CockroachDB admin UI (e.g., http://:8080) to assess whether the endpoint returns detailed error messages or exposes internal state that should be logged.

During a scan, middleBrick performs the following relevant checks:

• Input Validation – Sends malformed SQL payloads to the admin API and checks whether the response leaks stack traces or internal state without a corresponding audit entry.
• Authentication – Tests if the admin endpoint is accessible without credentials; if so, any action performed will not be tied to a user in the audit log.
• Data Exposure – Looks for responses that contain table schemas or query results that should have triggered an audit log entry for a SELECT operation.
• SSRF / Unsafe Consumption – Verifies that the admin API does not inadvertently allow forwarding requests to internal services, which could bypass logging.

middlebrick scan http://cockroach-db.example.com:8080