Email Injection in Feathersjs with Cockroachdb

Email Injection becomes relevant in a Feathersjs application backed by Cockroachdb when user-controlled data is used to construct email-related operations such as headers, recipients, or command strings. Feathersjs services are typically event-driven and rely on hooks to transform requests. If a hook or service action directly interpolates values like user.email or context.params.query.to into email headers or shell-like commands without validation, an attacker can inject additional email headers or commands.

With Cockroachdb as the data store, the risk is not in the database itself but in how data retrieved from Cockroachdb is used downstream. For example, if a Feathersjs service queries Cockroachdb for a user record and then uses record.email in an email-sending routine, an attacker who can influence stored data (e.g., via an IDOR or BOLA flaw) may supply an email value containing newline characters or SMTP command sequences such as %0d%0aCc: or %0d%0aBcc:. When this data is later used in a transport or mail helper that does not sanitize input, the injected lines can alter the recipient list or inject malicious headers.

The combination of Feathersjs hooks and Cockroachdb amplifies the issue when services perform concatenation or template interpolation without context-aware escaping. Consider a service that builds a mail command string using values directly from a Cockroachdb row. An attacker who can modify their own email field might store a value like attacker@example.com%0d%0aCc: victim@company.com. If the application later uses this field in a raw string to construct an email, the injected Cc header can cause the message to be sent to unintended recipients, leading to information disclosure or phishing amplification.

Because middleBrick scans test unauthenticated attack surfaces and include input validation checks, it can flag scenarios where email fields originating from Cockroachdb are reflected in mail operations without proper sanitization. The findings highlight the need to treat data from any persistent store as potentially tainted when it flows into communication protocols such as SMTP.

Remediation focuses on strict input validation, output encoding, and avoiding direct concatenation of user-influenced data into email commands. In Feathersjs, implement hooks that sanitize email fields before they are stored or used, and ensure that any interaction with Cockroachdb uses parameterized queries to avoid injection at the data layer.

When storing or updating email values in Cockroachdb from Feathersjs, use a service hook to normalize and validate the email. For example, you can add a before hook that validates the email format and removes any newline characters:

const { sanitize } = require('validator');

app.service('users').hooks({
  before: {
    create: [context => {
      if (context.data.email) {
        // Normalize and validate email, remove dangerous characters
        const normalized = sanitize(context.data.email.trim().toLowerCase());
        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
          throw new Error('Invalid email format');
        }
        // Remove CR/LF to prevent header injection
        context.data.email = normalized.replace(/[\r\n]+/g, '');
      }
      return context;
    }],
    update: [context => {
      if (context.data.email) {
        const normalized = sanitize(context.data.email.trim().toLowerCase());
        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
          throw new Error('Invalid email format');
        }
        context.data.email = normalized.replace(/[\r\n]+/g, '');
      }
      return context;
    }]
  }
});

When reading from Cockroachdb and using the email in an email transport, avoid building raw command strings. Instead, use a dedicated mail library that handles recipient lists safely. For example, using Nodemailer with a verified transport ensures that header injection is mitigated even if legacy data exists:

const nodemailer = require('nodemailer');
const { Client } = require('pg'); // Cockroachdb compatible PostgreSQL client

const transporter = nodemailer.createTransport({
  host: 'smtp.example.com',
  port: 587,
  secure: false,
  auth: { user: 'user', pass: 'pass' }
});

async function sendWelcomeEmail(userId) {
  const client = new Client({
    connectionString: 'postgresql://user:password@host:26257/dbname?sslmode=require'
  });
  await client.connect();
  const res = await client.query('SELECT email FROM users WHERE id = $1', [userId]);
  await client.end();

  const userEmail = res.rows[0].email;
  // Use library APIs that do not concatenate raw headers
  await transporter.sendMail({
    from: 'noreply@example.com',
    to: userEmail,
    subject: 'Welcome',
    text: 'Welcome to our service',
    // Do not manually build headers from user data
  });
}

Additionally, configure Feathersjs validation schemas to reject emails containing control characters or suspicious patterns. This prevents storage of values that could later exploit a mail subsystem. The combination of server-side validation, parameterized Cockroachdb queries, and safe mail libraries ensures that email-related functionality remains robust against injection attempts.