Dns Rebinding in Chi with Cockroachdb

Dns Rebinding is a client-side attack where an attacker tricks a victim’s browser into resolving a domain to an internal IP address after the initial DNS lookup. In a Chi application that exposes a Cockroachdb connection string or administrative endpoint to the browser—directly or via a misconfigured route—this can allow an attacker to pivot from a public-facing service to internal database or service endpoints.

Chi is a small, composable routing library for Clojure web applications. When routes inadvertently forward requests to internal services or return sensitive configuration (including Cockroachdb connection details) to the client, Dns Rebinding becomes viable. For example, a health-check route that returns the database connection host or a route that proxies requests to an internal Cockroachdb HTTP UI can be abused if host validation is missing.

An attacker might serve a page that resolves attacker.com to 127.0.0.1 after the initial load. If the Chi app exposes endpoints that accept a hostname parameter and forward requests to that host—such as a debug or introspection route that queries Cockroachdb—requests from the victim’s browser can reach internal Cockroachdb nodes. Because Cockroachdb may bind to localhost or a private network and trust internal connections, this can expose admin endpoints or allow unauthorized queries.

Consider a Chi route that dynamically constructs a Cockroachdb client URL from a request parameter without strict host allowlisting:

(ns example.routes.db
  (:require [cheshire.core :as json]
            [clj-http.client :as http]))

(defn cockroachdb-status-handler [req]
  (let [host (get-in req [:params :host]) ; user-supplied, no validation
        url (str "http://" host:8080/_status/health)]
    (try
      (let [resp (http/get url {:as :json})]
        (json/generate-string {:status (:status resp) :body (:body resp)}))
      (catch Exception e
        {:status 500 :body (str "Error: " (.getMessage e))}))))

If a route like this is reachable from the browser and the host parameter is not strictly validated, an attacker can supply internal addresses (e.g., localhost, 127.0.0.1, or a Cockroachdb node on a private network). The Chi handler forwards the request, and the victim’s browser triggers the request to the internal host, bypassing network-level isolation.

To mitigate this specific to Chi and Cockroachdb, enforce strict host allowlists for any route that interacts with or returns database endpoints, avoid echoing back database configuration to the client, and ensure that any proxying or introspection endpoints are not exposed to unauthenticated browser contexts. Use server-side checks and network segmentation so that Cockroachdb remains inaccessible to the public internet.

Remediation focuses on input validation, network separation, and avoiding exposure of internal endpoints to the client side. In Chi, validate all user inputs that influence network destinations and never forward browser-originated parameters directly to internal services.

Define an allowlist of permitted hosts for any database or admin interaction. If your Chi app must expose Cockroachdb health or metrics, perform those checks server-side and return only sanitized, non-sensitive data to the client.

Safe Chi handler with host allowlist:

(ns example.routes.db-safe
  (:require [cheshire.core :as json]
            [clj-http.client :as http]
            [ring.util.response :refer [response]]))

(def allowed-hosts #{"cockroachdb-internal.example.com" "localhost"})

(defn safe-cockroachdb-status-handler [req]
  (let [host (get-in req [:params :host])]
    (if (contains? allowed-hosts host)
      (try
        (let [url (str "http://" host:8080/_status/health)
              resp (http/get url {:as :json :timeout 5000})
              body (:body resp)]
          (response {:status (:status resp) :healthy (boolean body)}))
        (catch Exception e
          (response {:status 500 :error "health-check-failed"})))
      (response {:status 400 :error "host-not-allowed"}))))

Use Chi route constraints to ensure parameters conform to expected patterns and avoid open redirects or SSRF-like paths toward Cockroachdb:

(ns example.app
  (:require [compojure.core :refer [defroutes GET]
            [compojure.route :as route]
            [ring.util.response :refer [response]]
            [example.routes.db-safe :refer [safe-cockroachdb-status-handler]]
            [no.en.core :refer [env]]))

(defroutes app-routes
  (GET "/health/cockroachdb/:host" {params :params} (safe-cockroachdb-status-handler params))
  (route/not-found "Not found"))

For production, keep Cockroachdb endpoints bound to private networks and enforce authentication on any admin interfaces. Do not rely solely on Chi routing; use firewall rules and network policies to ensure Cockroachdb is not reachable from public contexts. Rotate credentials and avoid embedding connection strings in client-facing code or configuration that the browser can access.

middleBrick scans can surface routes that expose internal endpoints or unsafe parameter handling. If your Chi application interacts with Cockroachdb, consider scanning with middleBrick to detect unintended exposure of database-related routes before they can be abused via Dns Rebinding or other SSRF-style techniques.