Heap Overflow in Axum with Basic Auth

A heap-based buffer overflow in an Axum service that uses Basic Authentication can occur when user-controlled credentials are copied into a fixed-size buffer on the heap without proper length checks. Axum is a web framework built on hyper, and while Rust’s memory safety guarantees reduce the likelihood of classic heap overflows, unsafe blocks or unchecked integrations with C libraries can reintroduce the risk. When Basic Auth credentials are extracted from the Authorization header, decoded from Base64, and then forwarded into a buffer allocated on the heap with a static size, an attacker supplying an oversized token can overflow the allocation. This can corrupt adjacent heap metadata, leading to arbitrary code execution or crashes.

The vulnerability is exposed at the intersection of three elements: the parsing of the Authorization header, the use of fixed-capacity buffers on the heap, and the unchecked assumptions about credential length. For example, if a developer decodes the Base64 payload into a Vec<u8> but later passes it to a C FFI call that expects a buffer of fixed size, an oversized credential can overflow the heap block. Common patterns include storing usernames or passwords in fixed-size arrays on the heap or using a memory allocator that does not enforce strict bounds when resizing. Attack patterns such as CVE-2021-41773 (path traversal) illustrate how malformed input can bypass expected validation when parsing headers, and similar logic errors can manifest in heap handling when length validation is omitted.

In the context of middleBrick’s security checks, this vulnerability would appear as an input validation failure and potential data exposure. The scanner tests the unauthenticated attack surface and can detect whether overly long Basic Auth credentials trigger unexpected behavior. Findings include severity ratings and remediation guidance mapped to frameworks such as OWASP API Top 10 and PCI-DSS. To mitigate, developers should avoid fixed-size heap buffers for credentials, use Rust’s safe abstractions, and apply strict length checks before any decoding or forwarding operation.

Remediation focuses on eliminating fixed-size heap buffers and validating credential lengths before processing. In Axum, you should parse the Authorization header using safe Rust types and enforce length limits that align with realistic credential sizes. Below is a secure example that decodes Basic Auth credentials without exposing heap overflow risks:

use axum::{
    async_trait,
    extract::{self, FromRequest},
    http::request::Parts,
};
use base64::prelude::*;
use std::error::Error;

const MAX_BASIC_AUTH_LENGTH: usize = 1024; // reasonable upper bound

#[derive(Debug, Clone)]
struct BasicAuthCredentials {
    username: String,
    password: String,
}

#[async_trait]
impl FromRequest for BasicAuthCredentials
where
    S: Send + Sync,
{
    type Rejection = (axum::http::StatusCode, String);

    async fn from_request(req: extract::Request, _state: &S) -> Result {
        let auth_header = req.headers()
            .get(axum::http::header::AUTHORIZATION)
            .ok_or((axum::http::StatusCode::UNAUTHORIZED, "Missing Authorization header".to_string()))?
            .to_str()
            .map_err(|_| (axum::http::StatusCode::UNAUTHORIZED, "Invalid header encoding".to_string()))?
            .strip_prefix("Basic ")
            .ok_or((axum::http::StatusCode::UNAUTHORIZED, "Invalid Authorization scheme".to_string()))?;

        if auth_header.len() > MAX_BASIC_AUTH_LENGTH {
            return Err((axum::http::StatusCode::UNAUTHORIZED, "Authorization header too long".to_string()));
        }

        let decoded = BASE64_STANDARD.decode(auth_header)
            .map_err(|_| (axum::http::StatusCode::UNAUTHORIZED, "Invalid Base64 encoding".to_string()))?;

        if decoded.len() > MAX_BASIC_AUTH_LENGTH {
            return Err((axum::http::StatusCode::UNAUTHORIZED, "Decoded credentials too long".to_string()));
        }

        let parts: Vec<&str> = std::str::from_utf8(&decoded)
            .map_err(|_| (axum::http::StatusCode::UNAUTHORIZED, "Invalid UTF-8 in credentials".to_string()))?
            .splitn(2, ':')
            .collect();

        if parts.len() != 2 {
            return Err((axum::http::StatusCode::UNAUTHORIZED, "Invalid credentials format".to_string()));
        }

        Ok(BasicAuthCredentials {
            username: parts[0].to_string(),
            password: parts[1].to_string(),
        })
    }
}

async fn handler(credentials: BasicAuthCredentials) -> &'static str {
    "Authenticated"
}