Symlink Attack in Adonisjs with Cockroachdb

A symlink attack in AdonisJS when using CockroachDB occurs when an attacker manipulates file paths to create or follow symbolic links that redirect file operations outside the intended directory. This is a file-system and configuration concern, but it becomes more impactful when combined with CockroachDB because the database connection and migrations are often configured via local files and environment variables stored on disk.

AdonisJS applications typically use configuration files under config/ (e.g., database.ts) that reference CockroachDB connection parameters such as host, port, username, password, and database name. If an attacker can write to the application’s working directory through an insecure file upload, insecure deserialization, or a path traversal flaw, they may replace a legitimate file or directory with a symlink. For example, an attacker could symlink the AdonisJS configuration directory or a migration file to a location they control, causing the application to read malicious configuration that points to a rogue CockroachDB instance. When AdonisJS loads its configuration at runtime, it follows these symlinks, potentially exposing credentials or altering the target CockroachDB server without detection.

Another scenario involves logs or backups. AdonisJS applications using CockroachDB often write migration logs, schema snapshots, or query logs to local directories. If these outputs are written to user-writable locations and symlinks are not properly validated, an attacker can redirect a log write to a sensitive system file or trick the application into reading a malicious file as a schema definition. Even though CockroachDB itself is a distributed SQL database and does not directly interpret symlinks, the application layer’s handling of paths determines whether the database credentials and queries are redirected.

In a black-box scan, middleBrick tests for path traversal and symlink-prone behaviors by attempting directory traversal sequences (e.g., ../../../etc/passwd) and observing whether files outside the intended scope are accessible when database configuration is loaded. Because AdonisJS often resolves configuration paths relative to the project root, a symlink placed in a predictable temporary or upload directory can cause configuration poisoning. middleBrick’s LLM/AI Security checks also verify whether prompts or configuration instructions can be coerced into referencing unintended filesystem locations, which could indirectly affect how CockroachDB credentials are resolved.

To mitigate symlink risks in AdonisJS applications using CockroachDB, enforce strict path resolution and avoid relying on relative paths for sensitive configuration. Use absolute paths derived from a controlled base directory and validate that resolved paths remain within an allowed directory tree.

First, configure your AdonisJS database connection using absolute paths and environment variables without symlink-prone relative references. In config/database.ts, prefer explicit paths and avoid dynamic path concatenation that could be influenced by user input:

import { Env } from '@ioc:Adonis/Core/Env'

export default {
  connection: 'cockroachdb',
  connections: {
    cockroachdb: {
      client: 'cockroachdb',
      connection: {
        host: Env.get('DB_HOST', 'localhost'),
        port: Number(Env.get('DB_PORT', 26257)),
        user: Env.get('DB_USER', 'root'),
        password: Env.get('DB_PASSWORD', ''),
        database: Env.get('DB_NAME', 'default_db'),
        // Avoid constructing paths from user-controlled input
        extra: {
          ssl: {
            rejectUnauthorized: true,
          },
        },
      },
      debug: false,
    },
  },
}

Second, when handling file operations such as migrations or seed files, resolve paths using Node’s path.resolve and validate against a whitelisted base directory. For example, if your app imports migration files, ensure they resolve under the project’s database/migrations directory:

import { join } from 'path'
import { fs } from '@poppinss/utils'

const baseDir = '/opt/app/database/migrations'
const requested = 'user_provided_subdir/schema.sql'
const resolved = path.resolve(baseDir, requested)

if (!resolved.startsWith(baseDir)) {
  throw new Error('Invalid path: potential symlink traversal')
}

await fs.execViaChildProcess(`cockroach sql --execute="< ${resolved}" --url=${dbUrl}`)

Third, restrict file upload destinations and disable symlink creation in directories that the application reads configuration or migration files from. Configure your runtime environment to disallow symlinks in upload paths and audit your deployment pipeline for insecure temporary directories.

Finally, use middleBrick’s CLI to scan your AdonisJS endpoints and verify that configuration loading does not expose sensitive CockroachDB credentials via path manipulation. The dashboard can help track changes in risk scores over time, while the GitHub Action can fail builds if a scan detects findings that indicate path traversal or symlink risks in API configurations that interface with CockroachDB.