Dns Rebinding in Django with Cockroachdb

DNS Rebinding is a client-side attack where an attacker tricks a victim’s browser into bypassing same-origin policy by resolving a domain to an attacker-controlled IP, then switching the resolved IP to a target internal address. When this scenario involves a Django application that uses CockroachDB as its backend, the risk profile changes due to CockroachDB’s connection behavior and Django’s typical configuration patterns.

In a typical Django deployment with CockroachDB, developers configure the database using a host string that may resolve to a private or internal network address. During development or in misconfigured production environments, this host can be set to a hostname that is publicly resolvable initially but can be made to point elsewhere via DNS rebinding. Because CockroachDB accepts connections over long-lived sessions and supports HTTP/status endpoints for monitoring, an attacker who can trigger a rebinding via a malicious webpage loaded in the victim’s browser may cause Django to open a new database connection to the rebinded CockroachDB node. This can expose internal endpoints that were not intended to be reachable from the client-side context.

Django’s database connection pooling and the way it parses database settings from environment variables or settings files can inadvertently cache or reuse a resolved host. If CockroachDB’s advertised host is a domain name that can be rebound, and Django does not enforce strict host validation or network segmentation, the application may forward sensitive database queries over a manipulated network path. Although Django does not directly execute browser JavaScript, the attack chain often involves social engineering to get the victim to visit a page that triggers a WebSocket or HTTP request to a status endpoint exposed by CockroachDB’s admin UI or a custom Django view that proxies database diagnostics. This can lead to unauthorized data access or configuration introspection, especially if the CockroachDB node is reachable without additional authentication from the Django application’s network zone.

The combination is particularly risky when CockroachDB is deployed in a Kubernetes or containerized environment where internal services are exposed via internal DNS names. If those names are accidentally exposed through a Django management command or a debug endpoint that reflects database host information, an attacker can use DNS rebinding to map the internal topology. Because Django’s default settings may allow connections from localhost or internal network interfaces, and CockroachDB’s default bind address is often 0.0.0.0 in test scenarios, the attack surface expands. MiddleBrick scans detect such misconfigurations by testing unauthenticated endpoints and cross-referencing OpenAPI specs with runtime behavior, highlighting cases where database-related headers or status routes can be influenced via client-controlled DNS contexts.

To mitigate DNS Rebinding risks when using CockroachDB with Django, focus on hardening database connectivity, validating hosts, and isolating internal services. Below are concrete, actionable code examples tailored for Django projects that use CockroachDB.

1. Use IP addresses or tightly controlled hostnames in DATABASES

Avoid using dynamic or publicly resolvable hostnames for CockroachDB in your Django settings. Instead, use static IPs or internal service names that are not subject to DNS manipulation.

import os

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': os.getenv('COCKROACH_DB_NAME', 'mydb'),
        'USER': os.getenv('COCKROACH_USER', 'root'),
        'PASSWORD': os.getenv('COCKROACH_PASSWORD', ''),
        'HOST': '10.128.0.5',  # Use internal IP or fixed private hostname
        'PORT': '26257',
        'OPTIONS': {
            'sslmode': 'require',
        },
    }
}

2. Restrict database connections to internal networks via firewall and Kubernetes NetworkPolicy

Ensure CockroachDB pods or instances are not bound to 0.0.0.0. In Kubernetes, use NetworkPolicy to allow connections only from specific pods or namespaces running Django.

# CockroachDB StatefulSet snippet (not Django code, but deployment context)
# Ensure --advertise-host uses internal interface
- --advertise-host=eth0
- --listen-addr=10.128.0.5:26257
- --http-addr=10.128.0.5:8080

3. Validate and sanitize database host via custom management command or startup check

Add a Django management command or AppConfig ready method to verify that the database host is within an allowed set.

# myapp/management/commands/validate_db_host.py
from django.core.management.base import BaseCommand
from django.conf import settings
import socket

class Command(BaseCommand):
    help = 'Ensure database host is not publicly rebindable'

    def handle(self, *args, **options):
        host = settings.DATABASES['default']['HOST']
        try:
            resolved = socket.gethostbyname(host)
            if resolved.startswith(('10.', '192.168.', '172.16.', '172.17.', '172.18.', '172.19.', '172.20.', '172.21.', '172.22.', '172.23.', '172.24.', '172.25.', '172.26.', '172.27.', '172.28.', '172.29.', '172.30.', '172.31.')):
                self.stdout.write(self.style.SUCCESS(f'Database host {host} resolves to private IP {resolved}'))
            else:
                self.stderr.write(self.style.ERROR(f'Database host {host} resolves to public IP {resolved}'))
        except socket.gaierror as e:
            self.stderr.write(self.style.ERROR(f'Cannot resolve database host: {e}'))

4. Disable unused HTTP status endpoints on CockroachDB

If you do not need the built-in admin UI or status endpoints, disable them in the CockroachDB launch flags to reduce exposure.

# In CockroachDB start command
--insecure=false --http-addr=127.0.0.1:8080  # Bind to localhost only

5. Use Django middleware to block suspicious Host headers

Add middleware that rejects requests with atypical Host headers that could indicate rebinding attempts against Django views that proxy database status.

class HostValidationMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        allowed_hosts = {'api.mycompany.com', 'staging.mycompany.com'}
        if request.get_host().split(':')[0] not in allowed_hosts:
            from django.http import HttpResponseForbidden
            return HttpResponseForbidden('Invalid host')
        response = self.get_response(request)
        return response