Dns Cache Poisoning in Fiber with Basic Auth

Dns Cache Poisoning exploits weaknesses in DNS resolution to redirect traffic to malicious IPs. When an API built with Fiber uses HTTP Basic Authentication but relies on the underlying platform’s DNS lookups without additional safeguards, poisoned DNS responses can route authentication requests to an attacker-controlled host.

Consider a Fiber service that calls an upstream dependency (e.g., a user service or an identity provider) using a hostname. If the DNS cache is poisoned, the hostname resolves to an IP under attacker control. Because the request includes Basic Auth credentials in headers (e.g., Authorization: Basic base64(username:password)), the attacker can capture or manipulate those credentials. This risk is elevated when requests are made server-side from within Fiber handlers, where developers may assume DNS resolution is trustworthy. The scanner’s checks for SSRF and DNS-related weaknesses highlight this interaction, noting that unauthenticated or poorly constrained network calls can expose credentials even when Basic Auth is present.

middleBrick’s scans detect scenarios where DNS resolution is not constrained (e.g., missing custom resolvers or DNS-over-HTTPS) and where authentication headers traverse potentially compromised network paths. Findings include insecure dependency on DNS behavior and exposure of credentials via interception or redirection, mapped to OWASP API Top 10:2023 A3:2023 Injection (interpreted broadly to include resolution-layer confusion) and A7:2023 Identification and Authentication Failures. Remediation guidance emphasizes verifying endpoint IPs, avoiding reliance on default resolvers, and applying additional authorization checks beyond transport-level credentials.

To reduce DNS Cache Poisoning risks when using Basic Auth in Fiber, combine runtime DNS hardening with secure credential handling. Avoid passing sensitive headers to untrusted or dynamically resolved endpoints. Below are concrete Fiber examples demonstrating safer patterns.

Example 1: Explicit HTTP client with custom DNS resolver and secure headers

Use a dedicated HTTP client that allows custom DNS configuration and enforce strict transport settings. This reduces reliance on the system resolver and helps prevent redirection to malicious IPs.

const fiber = require('express');
const { Client } = require('undici'); // or native http module with custom resolver

const app = fiber();

// Configure a client with custom DNS resolution options if available
const upstream = new Client('https://api.example.com', {
  connect: {
    rejectUnauthorized: true,
    // If your runtime supports custom DNS servers, configure them here:
    // dns: { servers: ['1.1.1.1'] }
  }
});

app.get('/proxy', async (req, res) => {
  // Do not forward Authorization to untrusted destinations
  const auth = req.headers.authorization; // Incoming Basic Auth
  if (!auth) return res.status(401).send('Missing credentials');

  // Validate and map credentials server-side instead of proxying raw headers
  const token = await validateAndIssueInternalToken(auth);

  const response = await fetch('/users/me', {
    headers: {
      Authorization: `Bearer ${token}`, // Use internal token, not original Basic Auth
    },
  });
  const data = await response.json();
  res.json(data);
});

app.listen(3000);

Example 2: Middleware to strip risky headers and enforce destination allowlisting

Intercept outbound requests from Fiber handlers to ensure credentials are not sent to unexpected hosts. Use allowlists for hostnames and prefer IP-based or mTLS approaches where feasible.

const fiber = require('express');
const http = require('http');

const app = fiber();

const ALLOWED_HOSTS = new Set(['api.example.com', 'auth.example.com']);

function outboundMiddleware(req, res, next) {
  const parsed = new URL(req.url);
  if (!ALLOWED_HOSTS.has(parsed.hostname)) {
    return res.status(403).send('Destination not allowed');
  }
  // Remove or replace sensitive headers before forwarding
  delete req.headers['authorization'];
  req.headers['authorization'] = `Bearer ${issueScopedToken()}`;
  next();
}

app.use('/services/*', outboundMiddleware);

app.get('/services/users', (req, res) => {
  const options = {
    hostname: 'api.example.com',
    port: 443,
    path: '/users',
    method: 'GET',
    headers: {
      authorization: req.headers.authorization,
    },
  };

  const proxy = http.request(options, apiRes => {
    let data = '';
    apiRes.on('data', chunk => data += chunk);
    apiRes.on('end', () => res.send(data));
  });
  proxy.on('error', () => res.status(502).send('Upstream error'));
  proxy.end();
});

app.listen(3000);

Credential handling guidance

• Do not forward incoming Basic Auth headers directly to external endpoints; map to scoped tokens server-side.
• Validate endpoint hostnames against an allowlist and prefer fixed IPs when possible.
• Use environment variables or secure vaults for credentials rather than embedding them in code.
• Enable strict TLS verification and consider DNS-over-HTTPS if your runtime permits.