Ssrf in Echo Go with Cockroachdb

Server-Side Request Forgery (SSRF) in an Echo Go service that uses CockroachDB can occur when user-supplied input is used to construct HTTP requests or database connection parameters without adequate validation. In this stack, an attacker may supply a malicious URL or hostname that the backend resolves internally, leading to unintended network interactions from the server. Because CockroachDB often runs in distributed environments with internal service discovery and secure networking assumptions, SSRF can bypass expected network boundaries.

For example, if an Echo Go handler accepts a URL parameter to fetch external metadata and passes it to an HTTP client without restricting host resolution, the server can be tricked into probing internal CockroachDB SQL ports (26257) or admin endpoints that are not exposed externally. Even when CockroachDB is not directly targeted, SSRF can lead to metadata service access, internal API abuse, or lateral movement within a secured cluster. The risk is amplified when the application uses the same network namespace as CockroachDB nodes or relies on internal DNS names that the attacker cannot directly reach.

middleBrick scans such endpoints in black-box mode, testing how user input influences outbound requests and whether internal services become reachable. Findings include risk scores, severity, and remediation guidance mapped to frameworks like OWASP API Top 10 and common attack patterns like CVE-2020-28043-style SSRF in HTTP clients.

Remediation focuses on input validation, network controls, and safe handling of database and HTTP client configuration in Echo Go. Avoid using user input to drive outbound HTTP requests to internal addresses, and enforce strict allowlists for hosts and ports.

1. Validate and sanitize external URL input

Ensure any user-provided URL is parsed and checked against a denylist/blocklist of internal hosts and sensitive ports (e.g., CockroachDB’s 26257, 8080). Use Go’s net/url and net packages to resolve IPs and reject private ranges.

package main

import (
    "net"
    "net/http"
    "net/url"
    "strings"

    "github.com/labstack/echo/v4"
)

func isPrivateHost(host string) bool {
    ip := net.ParseIP(host)
    if ip != nil {
        return ip.IsPrivate()
    }
    // Fallback: check if host resolves to a private IP
    addrs, err := net.LookupIP(host)
    if err != nil {
        return true // fail-safe
    }
    for _, a := range addrs {
        if a.IsPrivate() {
            return true
        }
    }
    return false
}

func safeFetch(c echo.Context) error {
    target := c.QueryParam("url")
    parsed, err := url.Parse(target)
    if err != nil || parsed.Host == "" {
        return echo.NewHTTPError(http.StatusBadRequest, "invalid URL")
    }
    if isPrivateHost(parsed.Hostname()) {
        return echo.NewHTTPError(http.StatusForbidden, "private host not allowed")
    }
    // Safe to proceed with http.Get or a configured client
    resp, err := http.Get(parsed.String())
    if err != nil {
        return echo.NewHTTPError(http.StatusBadGateway, "fetch failed")
    }
    defer resp.Body.Close()
    return c.JSONBlob(http.StatusOK, nil) // placeholder
}

func main() {
    e := echo.New()
    e.GET("/fetch", safeFetch)
    e.Start(":8080")
}

2. Secure CockroachDB client configuration

When initializing CockroachDB clients in Go, avoid dynamic host/port construction from user input. Use environment variables or configuration files with explicit host lists and TLS settings. Example using pgx with context timeouts and DNS-based service discovery that does not rely on user-controlled values.

package main

import (
    "context"
    "os"
    "time"

    "github.com/jackc/pgx/v5/pgxpool"
)

func getDBPool() (*pgxpool.Pool, error) {
    // Use a fixed connection string; do not concatenate user input
    connStr := os.Getenv("COCKROACH_URL")
    if connStr == "" {
        connStr = "postgresql://root@localhost:26257/defaultdb?sslmode=require"
    }
    ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
    defer cancel()
    pool, err := pgxpool.New(ctx, connStr)
    if err != nil {
        return nil, err
    }
    // Set max connections and health check settings to reduce exposure
    pool.Config().MaxConns = 10
    return pool, nil
}

func main() {
    pool, err := getDBPool()
    if err != nil {
        panic(err)
    }
    defer pool.Close()
    // Use pool for queries safely
    var version string
    err = pool.QueryRow(context.Background(), "SELECT version()").Scan(&version)
    if err != nil {
        panic(err)
    }
}

3. Network and deployment considerations

Deploy CockroachDB in a private network with strict firewall rules. In Echo Go, avoid binding HTTP servers to interfaces that expose internal services. Use middleware to log and inspect outbound requests during development, and leverage middleBrick’s continuous monitoring (Pro plan) to detect unexpected network behavior in CI/CD pipelines.