Request Smuggling in Express with Cockroachdb

Request smuggling occurs when an Express application parses HTTP requests differently from the frontend proxy or load balancer, allowing an attacker to smuggle a request across security boundaries. When Cockroachdb is used as the backend database, smuggling can expose sensitive tenant data or enable unauthorized schema operations because the database enforces strict isolation between nodes and databases.

The risk is introduced when Express mixes chunked Transfer-Encoding requests with Content-Length-based routing while proxies terminate TLS and rewrite headers before forwarding to Cockroachdb-backed services. If the proxy uses one header interpretation and Express another, a smuggled request can reach a different route that directly queries Cockroachdb with connection strings or metadata taken from the original request. Because Cockroachdb connections in Node.js are often created per-request or from a shared pool, a smuggled request may execute SQL under a different authentication context, bypassing intended tenant checks.

For example, an attacker can send a request like:

POST /api/v1/users HTTP/1.1
Host: api.example.com
Content-Length: 5
Transfer-Encoding: chunked

0

GET /api/v1/admin/query?sql=SELECT+*+FROM+crdb_internal.node_databases HTTP/1.1
Host: cockroachdb-internal:26257

If Express parses the request as chunked and the proxy as Content-Length, the admin query can be routed to a Cockroachdb endpoint that returns database names, exposing cluster topology. Because the SQL is executed with whatever database permissions the Express service holds (often a high-privilege Cockroachdb role), the attacker can map the schema or attempt further injection.

middleBrick detects this class of issue under BOLA/IDOR and Unsafe Consumption checks, highlighting mismatched parsing and unauthenticated endpoint exposure that can affect Cockroachdb interactions. Findings include references to OWASP API Top 10 and potential compliance impacts under SOC2 and GDPR when data isolation is violated.

Remediation focuses on normalizing request parsing and ensuring database operations are isolated per tenant. Use a strict Content-Length limit and avoid falling back to chunked interpretation when the request body is expected to be small, such as API queries to Cockroachdb.

1. Enforce consistent parsing with the 'express-http-proxy' or a hardened proxy layer, and validate headers before building database clients:

const express = require('express');
const { Pool } = require('pg');

const app = express();
app.use(express.json({ limit: '1kb' }));

const pool = new Pool({
  connectionString: process.env.COCKROACHDB_URI,
  ssl: { rejectUnauthorized: false }
});

// Ensure no mixed encoding interpretations
app.use((req, res, next) => {
  if (req.headers['transfer-encoding'] && req.headers['content-length']) {
    return res.status(400).send('Conflicting transfer encodings');
  }
  next();
});

app.get('/api/v1/tenant/:id/users', async (req, res) => {
  const client = await pool.connect();
  try {
    const result = await client.query(
      'SELECT id, email FROM users WHERE tenant_id = $1',
      [req.params.id]
    );
    res.json(result.rows);
  } finally {
    client.release();
  }
});

module.exports = app;

2. Use Cockroachdb-specific role-based access control in connection strings and avoid shared superuser connections in Express:

const { Pool } = require('pg');

// Each tenant gets a scoped role; connection pool respects tenant header
const pool = new Pool({
  connectionString: `postgresql://tenant_app:${process.env.TENANT_PW}@${process.env.COCKROACHDB_HOST}:26257/${process.env.TENANT_DB}?sslmode=require`
});

// Verify tenant header matches connection metadata
app.use('/api/v1', async (req, res, next) => {
  const tenantId = req.headers['x-tenant-id'];
  if (!tenantId || !/^[a-z0-9-]+$/.test(tenantId)) {
    return res.status(403).send('Invalid tenant');
  }
  // Attach tenant-aware pool or override for read-only replicas if needed
  next();
});

3. Add schema validation for SQL inputs that reach Cockroachdb to prevent smuggling-induced injection:

const validateQuery = (sql, allowedTables) => {
  const normalized = sql.trim().replace(/\s+/g, ' ').toLowerCase();
  if (!normalized.startsWith('select')) throw new Error('Only SELECT allowed');
  if (!allowedTables.some(t => normalized.includes(t))) throw new Error('Table not allowed');
};

app.get('/api/v1/reports', async (req, res) => {
  const sql = 'SELECT * FROM crdb_internal.node_queries WHERE true';
  validateQuery(sql, ['node_queries', 'node_databases']);
  const client = await pool.connect();
  try {
    const result = await client.query(sql);
    res.json(result.rows);
  } finally {
    client.release();
  }
});

These steps reduce the attack surface by ensuring Express and its proxy interpret requests identically and that Cockroachdb connections are scoped with least privilege. middleBrick’s scans can highlight missing header normalization and overly permissive database roles that would amplify smuggling risks.