Man In The Middle in Actix with Cockroachdb

When an Actix web service communicates with a CockroachDB cluster, a Man In The Middle (MitM) attack can occur if transport security is not enforced end-to-end. CockroachDB supports TLS for client connections, and Actix applications typically interact with the database via a connection pool. If the Actix application connects without verifying the server certificate or without using encrypted connections, an attacker on the network path can intercept queries, modify responses, or inject malicious data.

The exposure is specific to the combination because CockroachDB nodes often form a distributed cluster that may accept connections on multiple interfaces. An Actix application that resolves a cluster name to multiple IPs may inadvertently route some connections through an unencrypted or spoofed node. In a black-box scan, middleBrick tests unauthenticated endpoints and checks for cleartext database metadata leakage; if an Actix endpoint exposes database-level details or errors that reference CockroachDB nodes, it can aid an attacker in mapping the topology and positioning for interception.

During a scan, middleBrick’s checks for Encryption and Data Exposure evaluate whether the API surface reveals sensitive information or accepts cleartext database traffic. Without enforced TLS in the Actix database client, credentials, query results, and session tokens can be read by an attacker. The risk is compounded when the Actix application uses HTTP redirects or mixed content, allowing an intermediate node to downgrade or alter traffic between the service and the CockroachDB cluster.

Secure the connection between Actix and CockroachDB by enforcing TLS with certificate validation. Use the rustls crate to configure a secure client and avoid accepting invalid certificates. The following example demonstrates a hardened Actix setup with a CockroachDB TLS connection string and a verified client builder.

use actix_web::{web, App, HttpServer, Responder};
use sqlx::postgres::{PgConnectOptions, PostgresConnectOptions};
use sqlx::ConnectOptions;
use std::time::Duration;

fn create_secure_options() -> PgConnectOptions {
    // Use a secure connection string with sslmode=verify-full
    // Example: postgresql://user:password@host:26257/dbname?sslmode=verify-full&sslrootcert=/path/to/ca.crt
    let mut options = "postgresql://myuser:mypass@cockroachdb-node1:26257,myuser:mypass@cockroachdb-node2:26257/mydb?sslmode=verify-full&sslrootcert=/certs/ca.crt"
        .parse::()
        .expect("valid connection string");
    options
        .connect_timeout(Duration::from_secs(10))
        .idle_timeout(Duration::from_secs(30))
        .max_lifetime(Duration::from_secs(300));
    options
}

async fn get_user_info(user_id: web::Path) -> impl Responder {
    let pool = sqlx::postgres::PgPoolOptions::new()
        .max_connections(5)
        .connect_with(create_secure_options())
        .await
        .expect("failed to create pool");

    let user_name: (String,) = sqlx::query_as("SELECT username FROM users WHERE id = $1")
        .bind(user_id.into_inner())
        .fetch_one(&pool)
        .await
        .expect("failed to fetch user");

    format!("User: {}", user_name.0)
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    HttpServer::new(|| {
        App::new()
            .route("/user/{id}", web::get().to(get_user_info))
    })
    .bind("0.0.0.0:8080")?
    .run()
    .await
}

Key practices to prevent MitM in this stack:

• Always use sslmode=verify-full and provide a trusted CA certificate via sslrootcert to ensure the server identity is verified.
• Restrict database listener bindings to internal networks and use firewall rules to limit exposure; avoid binding CockroachDB to public interfaces unless behind a secure gateway.
• Rotate TLS certificates regularly and keep the certificate bundle up to date within the Actix runtime environment.
• Validate server certificates strictly; do not disable hostname verification or use sslmode=disable in production.
• Enable audit logging in CockroachDB and monitor connection patterns from Actix services to detect unusual query origins that may indicate interception attempts.

Using the CLI, you can test your configuration by running middlebrick scan <url> to verify that your endpoints do not leak database metadata and that TLS is enforced. The Pro plan allows continuous monitoring of these configurations across multiple APIs, and the GitHub Action can fail builds if security scores drop below your defined threshold.