Dns Rebinding in Axum with Cockroachdb

DNS Rebinding is a client-side attack where a malicious webpage causes a victim’s browser to send requests to an internal or unexpected host by changing DNS answers after the initial page load. In an Axum service that exposes a Cockroachdb-backed HTTP API, this can occur when the application relies solely on origin checks (e.g., CORS or simple host validation) and forwards or displays database metadata, rows, or error messages that reference internal endpoints or schemas.

Consider an Axum handler that accepts a table name and returns rows from Cockroachdb without strict allowlisting. If the handler includes database or schema names in responses, or if frontend JavaScript uses the same API to introspect structure, an attacker can use a rebinding domain to coax the victim’s browser into making authenticated-looking requests to internal services that resolve to private IPs (e.g., Cockroachdb admin UI or a non-public API). Even when Cockroachdb is not directly exposed to the browser, verbose error messages containing table or column names can leak internal topology, aiding further exploitation via rebinding.

With the middleBrick LLM/AI Security checks, system prompt leakage detection and active prompt injection probes would identify whether Axum API responses or generated documentation expose internal routing, Cockroachdb connection hints, or schema details that could be weaponized during a rebinding scenario. Output scanning would catch PII or credentials that might be returned alongside database content, and excessive agency detection would flag overly broad tool-calling patterns in any integrated LLM workflows.

To mitigate this specific combination, treat the Axum endpoint set as an attack surface that should never echo database internals to the client. Validate and sanitize all inputs that reach Cockroachdb, use strict CORS policies, and avoid returning schema or host information in error messages. MiddleBrick’s OpenAPI/Swagger spec analysis can verify that $ref definitions and runtime responses do not disclose internal network details, which is critical when your spec describes Cockroachdb-backed resources.

Remediation focuses on input validation, strict allowlisting, and separating database metadata from client responses. Below are concrete Axum examples using the cockroachdb-rs driver.

• Define a safe, parameterized query that selects only approved columns:

use axum::{routing::get, Router};
use cockroachdb_rs::Client;
use serde::Serialize;

#[derive(Serialize)]
struct PublicUser {
    id: i64,
    display_name: String,
}

async fn get_user(
    user_id: String,
    db: &Client,
) -> Result<axum::Json, (axum::http::StatusCode, String)> {
    // Strict allowlist: only allow known-safe user_id format
    if !user_id.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_') {
        return Err((axum::http::StatusCode::BAD_REQUEST, "Invalid user_id".into()));
    }
    let row = db
        .query_one(
            "SELECT id, display_name FROM users WHERE id = $1",
            &[&user_id],
        )
        .await
        .map_err(|e| (axum::http::StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
    let user = PublicUser {
        id: row.get(0),
        display_name: row.get(1),
    };
    Ok(axum::Json(user))
}

fn app() -> Router {
    // db initialized elsewhere with secure connection string
    // let db = CockroachdbClient::new(...).await;
    Router::new().route("/users/:user_id", get(move |user_id| get_user(user_id, &db)))
}

• Enforce CORS and host validation at the Axum middleware layer:

use axum::{middleware::from_fn, routing::get, Router};
use axum_extra::headers::Origin;

async fn cors_middleware(
    request: axum::http::Request<axum::body::Body>,
    next: axum::middleware::Next,
) -> axum::http::Response<axum::body::Body> {
    let origin = request.headers().get("Origin");
    let allowed = "https://your-trusted-frontend.example.com";
    match origin.and(|o| o.to_str().ok().filter(|o| o == allowed)) {
        Some(_) => next.run(request).await,
        None => axum::http::Response::builder()
            .status(axum::http::StatusCode::FORBIDDEN)
            .body("Invalid origin".into())
            .unwrap(),
    }
}

fn app_with_cors() -> Router {
    Router::new()
        .route("/public", get(|| async { "ok" }))
        .layer(from_fn(cors_middleware))
}

• Ensure Cockroachdb connection strings and credentials are not exposed via environment introspection endpoints or logs:

// In practice, load from a secure vault or runtime secret, never echo in logs.
let database_url = std::env::var("COCKROACH_URL").expect("COCKROACH_URL must be set");
let client = cockroachdb_rs::Client::new(&database_url).await?;
// Avoid logging the full URL
log::info("Database client initialized");

These patterns reduce the attack surface for DNS Rebinding by ensuring that Axum does not reflect internal hostnames, schema details, or connection metadata to the browser. When combined with middleBrick’s continuous monitoring (Pro plan) and CI/CD integration, you can fail builds if new endpoints introduce risky reflection or overly broad data exposure.