Insecure Deserialization in Axum with Basic Auth

Insecure deserialization occurs when an application processes untrusted serialized data and reconstructs objects from it without sufficient validation. In an Axum service that also uses HTTP Basic Authentication, the combination of a deserialization endpoint and weak auth enforcement can amplify the impact of a deserialization flaw.

Consider an Axum handler that reads a serialized payload (for example, a Java serialized object, a Python pickle, or a YAML document) from a request body. If the handler reconstructs objects from that data without verifying integrity or type constraints, an attacker can craft malicious payloads that execute arbitrary code or change application behavior when deserialized. Even when Basic Auth is present, several factors can leave the deserialization path exposed:

• Basic Auth may be optional or applied only to a subset of routes, leaving the deserialization endpoint publicly reachable.
• Credentials may be passed in headers on each request, but if the handler trusts deserialized data to make authorization or routing decisions, an attacker can bypass intended access controls by manipulating object state.
• Developers might mistakenly assume that transport-layer authentication (Basic Auth) is sufficient to protect deserialization, leading to missing integrity checks on the payload itself.

For example, an attacker who discovers a debug or legacy endpoint that accepts serialized data could send a malicious payload along with valid Basic Auth credentials (obtained via phishing or credential stuffing). If the deserialization logic does not enforce strict type checks or a denylist of dangerous classes, the server may instantiate attacker-controlled objects, leading to remote code execution or sensitive data exposure. OWASP API Security Top 10 cites deserialization as a common vector, and frameworks like Axum do not provide built-in safeguards — developers must add explicit validation and integrity checks.

In a real-world scenario, an Axum API that exposes a POST /import endpoint to deserialize user-provided job configurations could be vulnerable if it uses unsafe deserialization libraries. Even with Basic Auth, a compromised or misconfigured account could allow an attacker to submit malicious serialized payloads. Findings from a middleBrick scan would highlight the missing integrity verification on deserialized data and recommend treating serialized input as hostile regardless of auth mechanisms.

Securing deserialization in Axum while using Basic Authentication requires both correct handling of credentials and strict controls on deserialized data. Below are concrete, safe patterns with working code examples.

1. Enforce Basic Auth consistently and validate credentials before processing any request

Use Axum extractors to require valid credentials on sensitive routes, and do not proceed to deserialization if authentication fails.

use axum::{
    async_trait, extract::FromRequest, http, response::IntoResponse, routing::post, Router,
};
use std::convert::Infallible;

struct AuthenticatedUser {
    username: String,
}

#[async_trait]
impl FromRequest<S> for AuthenticatedUser
where
    S: Send + Sync,
{
    type Rejection = (http::StatusCode, &'static str);

    async fn from_request(req: http::Request<axum::body::Body>) -> Result {
        let auth_header = req.headers().get("authorization");
        let Some(auth) = auth_header.and_then(|v| v.to_str().ok()) else {
            return Err((http::StatusCode::UNAUTHORIZED, "Missing authorization header"));
        };
        if !auth.starts_with("Basic ") {
            return Err((http::StatusCode::UNAUTHORIZED, "Invalid authorization type"));
        }
        let token = &auth[6..];
        // Decode and validate credentials (use constant-time comparison in production)
        let decoded = base64::decode(token).map_err(|_| (http::StatusCode::UNAUTHORIZED, "Invalid auth"))?;
        let creds = String::from_utf8(decoded).map_err(|_| (http::StatusCode::UNAUTHORIZED, "Invalid credentials"))?;
        let parts: Vec<&str> = creds.splitn(2, ':').collect();
        if parts.len() != 2 || parts[0] != "admin" || parts[1] != "secret" {
            return Err((http::StatusCode::UNAUTHORIZED, "Bad credentials"));
        }
        Ok(AuthenticatedUser { username: parts[0].to_string() })
    }
}

async fn import_handler(
    _user: AuthenticatedUser,
    body: String,
) -> Result<impl IntoResponse, (http::StatusCode, String)> {
    // Do NOT directly deserialize `body` here until integrity checks are applied
    Ok("Auth passed, but deserialization not performed")
}

#[tokio::main]
async fn main() {
    let app = Router::new().route("/import", post(import_handler));
    axum::Server::bind(&"0.0.0.0:3000".parse().unwrap())
        .serve(app.into_make_service())
        .await
        .unwrap();
}

use axum::{
    async_trait, extract::FromRequest, http, response::IntoResponse, routing::post, Json, Router,
};
use serde::{Deserialize, Serialize};
use std::convert::Infallible;

#[derive(Debug, Deserialize, Serialize)]
struct SafePayload {
    action: String,
    target: String,
}

async fn safe_import_handler(
    _user: AuthenticatedUser,
    Json(payload): Json<SafePayload>,
) -> Result<impl IntoResponse, (http::StatusCode, String)> {
    // Process validated structured data; no arbitrary deserialization
    Ok(format!("Action: {}, Target: {}"))
}

// In practice, reject any request that attempts to send content types
// like application/java-serialized-object or application/x-yaml without strict schema checks.