Dns Rebinding in Actix with Cockroachdb

DNS rebinding is a client-side attack that manipulates DNS responses to bypass same-origin policies, enabling a malicious site to make authenticated requests to a victim’s internal services. When an Actix web application exposes a Cockroachdb-backed endpoint to browser clients, a rebinding scenario can unfold if the frontend JavaScript is allowed to contact the backend indiscriminately and the backend does not enforce strict source validation.

Consider an Actix service that serves a web page including JavaScript fetched from the same host (e.g., https://api.example.com). If DNS for api.example.com resolves initially to a public IP but later resolves to an internal address such as 127.0.0.1 or a Cockroachdb node listening on a non-public port, the browser will send requests to the internal address. If the Actix backend accepts requests without verifying the origin or enforcing strict host-based access controls, the browser will include cookies or authentication tokens scoped to api.example.com, effectively allowing the attacker’s page to route commands to the database-facing layer.

In a Cockroachdb context, the risk amplifies when the Actix backend exposes query endpoints that accept parameters bound for SQL execution. A typical vulnerable pattern is an Actix handler that forwards unchecked user input into SQL statements targeting Cockroachdb without origin checks. An attacker can craft a page that makes requests to /query?sql=SELECT * FROM secrets, and due to rebinding, those requests resolve to an internal Cockroachdb listener or a compromised service that trusts local traffic. Because Cockroachdb often binds to localhost in development or binds to specific interfaces in production, rebinding can pivot the browser to reach a listener not intended for external access, bypassing network-level segmentation.

Moreover, if the Actix application uses cookies for session management without the SameSite attribute or Secure flag, and does not validate the Origin or Referer headers, the browser will automatically attach cookies during the rebinding request. This allows the attacker to execute SQL statements through the Actix service on behalf of the victim, leveraging the backend’s trust in local or authenticated loopback connections to Cockroachdb.

To detect this class of issue during scanning, tools that perform black-box testing can probe whether responses from the Actix backend include appropriate CORS headers, validate Origin constraints, and confirm that the service does not inadvertently allow cross-origin requests to endpoints that interact with Cockroachdb. The absence of these controls indicates a potential DNS rebinding vector that could lead to unauthorized data access or manipulation of the database through the Actix application layer.

Mitigating DNS rebinding in an Actix service that interfaces with Cockroachdb requires a combination of network-hardening, strict request validation, and secure session handling. Below are concrete, actionable fixes with code examples tailored to Actix and Cockroachdb.

1. Enforce Origin and Host Validation in Actix

Ensure every request that could affect Cockroachdb interactions validates the Origin and Host headers. In Actix, you can implement a middleware or a guard to reject unexpected origins.

use actix_web::{dev::ServiceRequest, Error, middleware::Next};
use actix_web_httpauth::extractors::bearer::BearerAuth;

async fn validate_origin(req: ServiceRequest, next: Next) -> Result<actix_web::HttpResponse, Error> {
    let origin = req.headers().get("Origin").and_then(|v| v.to_str().ok());
    let host = req.headers().get("Host").and_then(|v| v.to_str().ok());
    match (origin, host) {
        (Some(orig), Some(h)) if orig == "https://api.example.com" && h.starts_with("api.example.com") => {
            Ok(next.run(req).await)
        },
        _ => Err(actix_web::error::ErrorForbidden("Invalid origin or host")),
    }
}

This pattern ensures that only requests with a trusted origin and host proceed, reducing the attack surface for rebinding.

2. Use Parameterized Queries with Cockroachdb

Never concatenate user input into SQL strings. Use prepared statements with the sqlx or postgres crate to interact with Cockroachdb safely. Here is an example using sqlx with Actix web:

use actix_web::web;
use sqlx::postgres::PgPoolOptions;
use serde::{Deserialize, Serialize};

#[derive(Deserialize)]
struct QueryParams {
    table_name: String,
    filter_id: i32,
}

#[derive(Serialize)]
struct Record {
    id: i32,
    data: String,
}

async fn safe_query(
    params: web::Query,
    pool: web::Data<sqlx::PgPool>,
) -> Result<web::Json<Vec<Record>>, actix_web::Error> {
    // Use parameterized queries; table names cannot be parameterized in SQL,
    // so validate against an allowlist.
    let allowed_tables = ["users", "orders", "products"];
    if !allowed_tables.contains(¶ms.table_name.as_str()) {
        return Err(actix_web::error::ErrorBadRequest("Invalid table"));
    }
    let records = sqlx::query_as(&format!("SELECT id, data FROM {}", params.table_name))
        .bind(params.filter_id)
        .fetch_all(pool.get_ref())
        .await
        .map_err(|e| actix_web::error::ErrorInternalServerError(e.to_string()))?;
    Ok(web::Json(records))
}

By validating the table name against an allowlist and using bind variables for values, you prevent injection and reduce the impact of a rebinding-induced request.

3. Secure Cookies and Session Management

Ensure cookies used for session management in Actix include SameSite and Secure attributes. If you’re using Actix-web’s cookie session support, configure them explicitly:

use actix_session::CookieSession;
use actix_web::App;

App::new()
    .wrap(
        CookieSession::signed(&[0; 32])
            .secure(true)
            .same_site(actix_web::cookie::SameSite::Strict),
    )

This prevents cookies from being sent in cross-origin requests, which is a key enabler for DNS rebinding attacks.

4. Network and Service Hardening

While not directly an Actix code fix, ensure Cockroachdb is not exposed on localhost to external clients unless strictly required. Bind Cockroachdb to specific interfaces and use firewall rules to restrict access to the Actix backend. In development, prefer connecting via secure tunnels rather than public DNS that can be manipulated.

5. Continuous Monitoring and Scanning

Use the middleBrick CLI to scan your Actix endpoints regularly, especially if they interface with Cockroachdb. Running middlebrick scan <url> will detect missing CORS policies, missing host validation, and other misconfigurations that could facilitate DNS rebinding. For teams managing multiple services, the Pro plan’s continuous monitoring can schedule scans and alert on regressions, while the GitHub Action can gate merges if a security score drops below your defined threshold.