Privilege Escalation in Chi with Cockroachdb

Privilege Escalation (BFLA) in chi when backed by cockroachdb often stems from how route-level authorization is composed with database permissions and identity boundaries. Chi is a lightweight, idiomatic router for Go; when authorization checks are performed in application code before issuing SQL, an incomplete check can allow an authenticated user to change path parameters (e.g., userID) and issue requests that the handler does not validate against the requesting identity. If the application uses a shared, high-privilege CockroachDB role for efficiency, the impact is severe because an attacker can leverage a low-privilege API token to run statements that would normally require elevated rights.

In a typical Chi pattern, a route like /users/{userID} uses middleware to attach a subject (user ID, roles) to the request context. The downstream handler then builds queries using that context, for example by substituting userID from the URL into SQL. If the handler does not re-assert that the authenticated subject owns or is allowed to act on the target userID, an attacker can tamper with the URL to access or modify another user’s data. This becomes a privilege escalation when the CockroachDB role used by the application has broader permissions (e.g., SELECT, INSERT, UPDATE on many tables) and the application relies solely on Chi middleware for authorization without per-row ownership checks.

Cockroachdb-specific nuances compound this: CockroachDB supports role-based privileges and row-level security (via CREATE POLICY on secondary indexes), but if policies are defined on server side yet the application never pushes the principal into the SQL session (e.g., via SET ROLE or session variables), server-side enforcement may be bypassed when the application filters rows in Go. An attacker can exploit missing or misaligned checks between Chi routing, context propagation, and CockroachDB policies to read or modify data across tenants. For example, an endpoint intended to be tenant-isolated might rely only on Chi middleware to reject cross-tenant IDs, while the CockroachDB role has broad access, allowing enumeration or manipulation if the check is skipped.

Real-world patterns to watch for include: using a single database user for many services, failing to validate path parameters against the authenticated subject in each handler, and assuming CockroachDB network or VPC isolation replaces application-level authorization. Because middleBrick tests Authorization and BOLA/IDOR in parallel, it can surface these misalignments between Chi routing logic and CockroachDB permissions during an unauthenticated scan, highlighting endpoints where escalation is possible.

Remediation centers on ensuring every data access in Chi handlers is constrained by the authenticated subject and validated against CockroachDB policies. Use explicit per-request roles or tenant context, and push authorization into SQL where possible. Below are concrete, working examples for Chi with CockroachDB that demonstrate defense-in-depth.

1. Enforce ownership in Chi middleware and SQL

Define a middleware that extracts subject identity and attaches it to the request context, then use it in handlers to scope queries. Avoid relying on URL parameters alone.

// main.go
package main

import (
	"context"
	"database/sql"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

type ctxKey string
const userKey ctxKey = "user"

func withUser(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// Assume authentication middleware already set userID in context
		userID := r.Context().Value("userID")
		ctx := context.WithValue(r.Context(), userKey, userID)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

func getUserProfile(db *sql.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		userID := chi.URLParam(r, "userID")
		subjectID := r.Context().Value(userKey).(string)

		// Critical: ensure the subject matches the requested userID
		if subjectID != userID {
			http.Error(w, "forbidden", http.StatusForbidden)
			return
		}

		var email string
		// CockroachDB: use $1 placeholder; scope by subjectID
		row := db.QueryRow(r.Context(), "SELECT email FROM profiles WHERE user_id = $1", userID)
		if err := row.Scan(&email); err != nil {
			http.Error(w, "not found", http.StatusNotFound)
			return
		}
		w.Write([]byte(email))
	}
}

2. Use tenant-aware roles and SET ROLE in CockroachDB

Create a lightweight role per tenant or per user scope, and set the role at connection or per-request. This ensures CockroachDB enforces privilege boundaries even if application logic is bypassed.

-- CockroachDB setup: create tenant roles
CREATE ROLETAG tenant_123;
GRANT SELECT, INSERT ON TABLE profiles TO ROLE tenant_123;

-- Example session setup from Go (using a connection pool per tenant or SET ROLE)
-- This ensures SQL-level enforcement; Chi handlers can issue SET ROLE safely.

In practice, you can use a connection pool per tenant or execute SET ROLE tenant_123 at the start of a request (within a transaction if needed). Chi middleware can compute the tenant and run the SET before invoking the handler chain.

3. Combine Chi middleware with CockroachDB row policies

Define row-level security policies in CockroachDB that mirror application rules, and ensure the SQL user used by Chi does not bypass them. Avoid granting blanket SELECT/UPDATE on shared tables.

-- CockroachDB policy example (requires enterprise or suitable edition features)
ALTER TABLE profiles ADD CONSTRAINT profiles_tenant_check
CHECK (tenant_id = current_setting('app.tenant_id')::UUID);

-- In Chi handler, set session variable before query
_, err := db.Exec(r.Context(), "SET app.tenant_id = $1", tenantID)
if err != nil {
	http.Error(w, "internal", http.StatusInternalServerError)
	return
}
var data string
row := db.QueryRow(r.Context(), "SELECT data FROM profiles WHERE id = $1", profileID)

4. Use parameterized queries and avoid concatenation

Always use placeholders to prevent SQL injection and ensure predicate pushdown works with CockroachDB indexes. This complements Chi’s routing safety and reduces risk of privilege escalation via malicious input.

// Correct: parameterized
row := db.QueryRow(r.Context(), "SELECT role FROM users WHERE id = $1 AND tenant_id = $2", userID, tenantID)

// Avoid: string concatenation
// "SELECT role FROM users WHERE id = " + userID

By aligning Chi routing validation with CockroachDB role and row policies, and by scoping each request to a least-privilege SQL role, you reduce the attack surface for privilege escalation. middleBrick can help detect gaps where authorization in Chi does not map to database-level constraints during scans.