Dns Rebinding in Chi with Dynamodb

Dns Rebinding is a client-side attack that manipulates DNS responses to make a browser send requests to an IP address that differs from the initially resolved hostname. When this occurs in a Chi application that interacts with Amazon DynamoDB, the risk pattern changes depending on how the service is accessed and whether the client-side code or server-side endpoints are involved.

Chi is a routing library for the Clojure ecosystem, typically used to build HTTP services. If a Chi service queries DynamoDB using server-side code, the server is the direct caller and the client is not involved in DNS resolution for DynamoDB. In that case, Dns Rebinding does not apply to the server-to-DynamoDB path because the server uses standard TCP/HTTPS connections with certificate validation and does not rely on browser DNS behavior.

However, Dns Rebinding becomes relevant in two realistic contexts when using Chi with DynamoDB:

1. You expose a Chi endpoint that returns temporary AWS credentials or pre-signed URLs to the browser, and the browser uses those to directly call DynamoDB (for example, via the AWS SDK for JavaScript). An attacker can use Dns Rebinding to redirect the browser’s subsequent request to a malicious server that listens on a trusted IP (such as 127.0.0.1 or a corporate service IP), potentially tricking the browser into sending sensitive data or making unauthorized requests.
2. Your Chi application serves a web frontend (HTML/JavaScript) that calls Chi endpoints which in turn query DynamoDB. If the frontend is hosted on the same host as the Chi service and an attacker can force the frontend’s origin to resolve to a malicious server, Dns Rebinding may allow the attacker to bypass same-origin policies and interact with the Chi endpoints in ways that violate intended access controls.

DynamoDB itself does not participate in DNS rebinding because it is accessed over HTTPS with strict certificate pinning on the client or server. The danger arises from how the client obtains and uses credentials or URLs, not from DynamoDB’s network behavior. Therefore, the vulnerability in a Chi + DynamoDB setup is about exposure of long-lived credentials or overly permissive CORS and endpoint behaviors that allow a browser to be redirected to internal IPs after initial authentication.

To mitigate this, avoid returning sensitive credentials or pre-signed URLs that grant broad DynamoDB access to browser-side JavaScript. If you must provide temporary access, use short-lived tokens, strict CORS policies, and scope-down IAM policies that limit actions and resources. Additionally, ensure that any Chi endpoints that serve dynamic content validate the Host header and do not rely on IP-based trust for authorization.

Remediation focuses on preventing the exposure of sensitive access mechanisms to the browser and ensuring that server-side calls to DynamoDB remain trusted. Below are concrete patterns and code examples for a Chi application.

1. Avoid returning AWS credentials or pre-signed URLs to the browser

Instead of generating a pre-signed URL for DynamoDB operations that the browser will perform directly, perform all DynamoDB interactions server-side. The client sends intent (e.g., request data with a specific key), and the Chi handler performs the operation using the AWS SDK for Java or another server-side SDK.

(ns myapp.handler
  (:require [cheshire.core :as json]
            [aws.sdk.dynamodb :as ddb]))

(defn get-item-handler [request]
  (let [table-name "my-table"
        key {"id" {:s (get-in request [:params :id])}}
        resp (ddb/get-item {:db-client (ddb/client {:region "us-east-1"})
                            :table-name table-name
                            :key key})]
    {:status 200
     :headers {"Content-Type" "application/json"}
     :body (json/generate-string (:item resp))}))

This ensures that no temporary credentials or signed URLs are exposed to the client, eliminating a common Dns Rebinding vector where a browser is redirected to internal AWS metadata or internal services after obtaining credentials.

2. Harden CORS and validate Host headers in Chi routes

Configure CORS strictly and validate the Host header to prevent open redirects or host-header attacks that could be combined with Dns Rebinding.

(ns myapp.routes
  (:require [compojure.core :refer [GET defroutes]]
            [ring.util.response :refer [response]]
            [myapp.handler :refer [get-item-handler]]))

(def allowed-origins #{"https://app.example.com"})

(defn wrap-cors [handler]
  (fn [request]
    (let [origin (get-in request [:headers "origin"])]
      (if (and origin (contains? allowed-origins origin))
        (-> (handler request)
            (assoc-in [:headers "Access-Control-Allow-Origin"] origin)
            (assoc-in [:headers "Access-Control-Allow-Methods"] "GET,OPTIONS"
                      :headers "Access-Control-Allow-Headers" "Content-Type"))
        {:status 403
         :headers {"Content-Type" "text/plain"}
         :body "Forbidden"}))))

(defn wrap-validate-host [handler]
  (fn [request]
    (if (= (get-in request [:headers "host"]) "api.example.com")
      (handler request)
      {:status 400
       :headers {"Content-Type" "text/plain"}
       :body "Bad request"})))

(defroutes app-routes
  (GET "/items/:id" [] get-item-handler))

(def app
  (-> app-routes
      wrap-cors
      wrap-validate-host))

3. Use scoped-down IAM roles for server-side calls

Ensure the IAM role or user associated with the Chi application has minimal permissions on DynamoDB (e.g., dynamodb:GetItem for a specific table ARN). This limits the impact of any server-side compromise and prevents broader abuse even if an attacker tricks the server into making unintended calls.

4. Do not expose internal endpoints via dynamic configuration

Ensure that any endpoint or service discovery mechanisms used by the Chi application do not allow an attacker to influence the target host or IP used for DynamoDB calls. Avoid dynamic endpoint configuration that could be poisoned via request parameters or environment variables controlled by an attacker.

By combining server-side operations, strict CORS, host validation, and scoped IAM policies, you reduce the attack surface for Dns Rebinding when using Chi with DynamoDB.