Ssrf in Chi with Dynamodb

Server-Side Request Forgery (SSRF) in a Chi application that interacts with Amazon DynamoDB can expose internal services and bypass network-level protections. Chi is a lightweight, composable routing library for Clojure web services, and when endpoint handlers construct HTTP requests to external or internal resources based on untrusted input, SSRF becomes possible. If those requests also include AWS credentials or metadata calls intended for DynamoDB, an attacker can force the service to interact with internal AWS metadata endpoints or restricted DynamoDB endpoints.

In a Chi-based service, routes are typically defined using :get or :post with handlers that may call AWS SDKs to perform DynamoDB operations such as GetItem or Query. If user-supplied input (e.g., a URL or host parameter) is used to build an HTTP client request without strict validation, an attacker can supply values like http://169.254.169.254/latest/meta-data/iam/security-credentials/ to reach the EC2 instance metadata service. From there, credentials can be chained to make signed DynamoDB API calls, leading to data exfiltration or unauthorized table access.

The risk is amplified when the application uses the same HTTP client for both internal logic and external AWS interactions. For example, a Chi handler that fetches a remote configuration file and then uses that data to initialize a DynamoDB client may inadvertently allow an attacker to control the target host of the configuration request, redirecting it to internal AWS metadata. Because DynamoDB requests often require signing with IAM credentials, compromising the associated credentials obtained via SSRF can lead to further compromise of AWS resources.

middleBrick detects SSRF as part of its 12 security checks, including unauthenticated endpoint testing that can identify whether a Chi endpoint reflects or forwards user input to internal services. The scanner looks for patterns such as unchecked redirects, dynamic URL construction, and metadata endpoint access without network isolation. By correlating OpenAPI specifications with runtime behavior, middleBrick can highlight whether DynamoDB-related endpoints are exposed to SSRF-prone inputs, providing prioritized findings with severity and remediation guidance.

To remediate SSRF in Chi applications that interact with DynamoDB, enforce strict input validation and avoid using user-controlled data to construct HTTP requests or AWS client configurations. Use allowlists for known-safe hosts and disable redirect following for HTTP clients. When initializing DynamoDB clients, provide explicit region and credential sources that do not depend on runtime input.

Below are concrete code examples for a Chi application using the integrant library and the official AWS SDK for Clojure.

(ns myapp.routes
  (:require [compojure.core :refer [defroutes GET POST]]
            [clj-http.client :as http]
            [aws.sdk.dynamodb :as ddb]
            [ring.util.response :as resp]))

;; Safe DynamoDB client initialization with fixed configuration
(defn build-ddb-client []
  (ddb/client {:region "us-east-1"
               :creds (ddb/credentials :provider-chain)}))

;; Handler that avoids user-controlled URLs
(defn get-item-handler [request]
  (let [table (:table request) ;; validated against allowlist
        key (:key request)]
    (if (#{"users" "orders"} table)
      (try
        (let [client (build-ddb-client)
              item (ddb/get-item client {:table-name table :key key})]
          (resp/json-response item))
        (catch Exception e
          (resp/internal-server-error {:error (.getMessage e)})))
      (resp/bad-request {:error "invalid table"}))))

;; Chi route definition
(defroutes api-routes
  (GET "/item" request (get-item-handler request)))

In this example, the DynamoDB table name is validated against a strict allowlist, and the HTTP client used for any external calls should have redirects disabled. Avoid passing user input directly into URL constructors or AWS client builders. For more complex workflows, use middleware to sanitize inputs and enforce network-level isolation between internal services and external AWS endpoints.

middleBrick’s CLI can be used to scan a Chi endpoint with middlebrick scan <url>, while the GitHub Action adds API security checks to your CI/CD pipeline, failing builds if risk scores drop below your defined threshold. The Pro plan supports continuous monitoring so that any regression in API security posture is reported promptly via Slack or Teams alerts.