Dns Rebinding in Axum with Firestore

DNS Rebinding is an application-layer attack where an adversary tricks a victim’s browser into resolving a domain name to an internal IP address that is not publicly routable, such as 127.0.0.1 or a Cloud Firestore emulator on localhost. In a typical web setup, a Rust Axum service might accept requests that include host or origin headers that are not validated, allowing a malicious page served from an external domain to pivot to internal endpoints.

When Axum routes are not carefully constrained and Firestore access is mediated through an internal or local endpoint (such as an emulator used during development), DNS Rebinding can expose Firestore-bound operations to a remote attacker. For example, an attacker could host a page that makes authenticated requests to your Axum application; if the application resolves a hostname per request (e.g., via configuration or a service discovery step) and does not enforce strict hostname or IP allowlisting, the request may be redirected to localhost where the Firestore emulator is listening. This can bypass intended network segregation and allow unintended interactions with Firestore rules that might be more permissive in a local environment.

In this context, the Axum server may inadvertently trust the resolved address and pass it to Firestore client logic. If the Firestore client is configured to point at a local emulator via a hostname that can be rebinding, the attacker can interact with the Firestore instance directly through the Axum service’s route handlers. Even if the production Firestore instance requires authentication, a local emulator might have loose rules, enabling reads or writes that should not be permitted from external origins. The attack leverages weak hostname validation and overly permissive CORS or origin checks in the Axum layer to pivot from a public-facing domain to an internal service.

To illustrate, consider an Axum route that dynamically constructs a Firestore client based on a request parameter or environment variable without verifying that the target host is a trusted production endpoint. A rebinding payload can cause the client to connect to 127.0.0.1:8080 (emulator) instead of the intended remote Firestore host, exposing local data and rules. This is especially risky when developers rely on convenience configurations during testing and forget to remove or secure them before deployment.

Mitigating DNS Rebinding in this specific stack requires strict validation of hostnames and origins at the Axum layer, ensuring that Firestore client configurations are static and refer only to authorized remote endpoints, and avoiding runtime hostname resolution for sensitive services. MiddleBrick’s unauthenticated scan can detect such exposure by checking whether endpoints inadvertently allow internal resolution and whether CORS and origin checks are sufficient to prevent cross-origin pivoting to local Firestore interfaces.

Remediation centers on preventing untrusted input from influencing hostname resolution and ensuring Firestore clients are configured with fixed, authorized endpoints. In Axum, you should avoid deriving hostnames or ports from request data, and instead rely on configuration that is validated at startup.

First, enforce a strict allowlist of permitted origins and validate the Origin and Host headers in your Axum middleware or route guards. This prevents a malicious site from successfully interacting with your handlers if they attempt rebinding.

use axum::{
    async_trait,
    extract::{FromRequest, Request},
    http::StatusCode,
    response::IntoResponse,
};
use std::collections::HashSet;

struct AllowedOrigins(HashSet);

#[axum::async_trait]
impl FromRequest for AllowedOrigins
where
    S: Send + Sync,
{
    type Rejection = (StatusCode, &'static str);

    async fn from_request(req: Request, _state: &S) -> Result {
        let origin = req.headers().get("origin")
            .and_then(|o| o.to_str().ok())
            .unwrap_or("");
        let host = req.headers().get("host")
            .and_then(|h| h.to_str().ok())
            .unwrap_or("");
        let allowed: HashSet = ["https://myapp.example.com".to_string()].into_iter().collect();
        if allowed.contains(origin) && host.ends_with("myapp.example.com") {
            Ok(AllowedOrigins(allowed))
        } else {
            Err((StatusCode::FORBIDDEN, "Origin not allowed"))
        }
    }
}

async fn handler(AllowedOrigins(_): AllowedOrigins) -> &'static str {
    "OK"
}

use google_cloud_firestore::client::Client;
use google_cloud_firestore::auth::CredentialsFile;

async fn build_firestore_client() -> Client {
    // Use a fixed project and authorized remote host; avoid environment variables that can be changed at runtime
    let credentials = CredentialsFile::new("path/to/service-account.json").expect("valid credentials");
    Client::new(credentials)
        .await
        .expect("Firestore client creation")
}