Integer Overflow in Aspnet with Mutual Tls

An integer overflow in an ASP.NET API endpoint can occur when arithmetic on request values wraps around type limits (for example, using unchecked 32-bit math to compute buffer sizes or loop bounds). When mutual TLS (mTLS) is enforced, the server validates the client certificate before application logic runs. This does not prevent an integer overflow in business logic, but it changes the context of exploitation and detection.

Consider a case where an endpoint accepts an integer parameter for page size or batch size without validating range or using a checked context:

int batchSize = int.Parse(Request.Query["size"]);
byte[] buffer = new byte[batchSize * sizeof(int)]; // unchecked multiplication

An attacker can supply values that cause the multiplication to overflow, allocating a smaller buffer than expected and enabling subsequent memory safety issues or logic bypass. With mTLS, the request arrives with a valid client certificate, which may cause logging, monitoring, or WAF rules to treat the request as trusted and reduce scrutiny on its parameters. Moreover, mTLS enforces identity, so an authenticated client (presented as a user or service) might be allowed to hit endpoints that process high-volume or privileged operations, increasing the impact of a successful overflow. The scan checks such unchecked arithmetic and highlights it as a BFLA/Privilege Escalation or Unsafe Consumption risk, especially when high-trust channels (mTLS) coexist with unchecked numeric processing.

In the context of the 12 security checks, an integer overflow is typically surfaced under Unsafe Consumption and Property Authorization dimensions. It is important to recognize that mTLS secures transport and peer identity but does not automatically validate input correctness; developers must still apply range checks, use larger numeric types (e.g., long), or employ language features that enable checked arithmetic to prevent wrap-around.

To remediate integer overflow in ASP.NET while using mutual TLS, combine input validation and safe arithmetic with proper mTLS configuration. Below are concrete code examples and configuration guidance.

1. Validate input ranges and use checked contexts

Always validate incoming integers and use checked blocks to detect overflow at runtime:

if (!int.TryParse(Request.Query["size"], out int size) || size <= 0 || size > 10_000)
{
    return Results.BadRequest("Invalid size.");
}
checked
{
    try
    {
        int bufferSize = size * sizeof(int);
        byte[] buffer = new byte[bufferSize];
        // process buffer
    }
    catch (OverflowException)
    {
        return Results.BadRequest("Size causes overflow.");
    }
}

2. Use long or larger numeric types and explicit bounds

For sizes that may exceed int range, use long and enforce strict upper bounds:

if (!long.TryParse(Request.Query["size"], out long size) || size <= 0 || size > 10_000)
{
    return Results.BadRequest("Invalid size.");
}
long bufferSize = size * sizeof(int);
if (bufferSize > int.MaxValue)
{
    return Results.BadRequest("Size too large.");
}
byte[] buffer = new byte[(int)bufferSize];

3. Configure mutual TLS in ASP.NET

Enforce client certificates in ASP.NET Core via Kestrel configuration and middleware checks:

// Program.cs
var builder = WebApplication.CreateBuilder(args);
builder.WebHost.ConfigureKestrel(serverOptions =>
{
    serverOptions.ListenAnyIP(5001, listenOptions =>
    {
        listenOptions.UseHttps(httpsOptions =>
        {
            httpsOptions.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
            httpsOptions.AllowedCipherSuites = new[]
            {
                // restrict to strong cipher suites as needed
                TlsCipherSuite.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
            };
        });
    });
});

// Optionally validate certificate details in middleware
app.Use(async (context, next) =>
{
    var cert = context.Connection.ClientCertificate;
    if (cert == null || !IsValidClientCertificate(cert))
    {
        context.Response.StatusCode = 403;
        return;
    }
    await next();
});

app.Run();

4. Combine mTLS identity with authorization and logging

Even with mTLS, apply role-based or policy-based authorization and log suspicious parameter values to detect probing:

// Example policy-based check
if (!User.HasClaim(c => c.Type == "scope" && c.Value == "batch:write"))
{
    return Results.Forbid();
}
_logger.LogInformation("Request from {Subject} with serial {Serial} for size {Size}",
    context.User.Identity?.Name,
    context.Connection.ClientCertificate?.GetSerialNumberString(),
    size);

By validating input, using checked arithmetic, enforcing mTLS, and monitoring behavior, you reduce the likelihood and impact of integer overflows in an mTLS-protected ASP.NET service.