Out Of Bounds Read in Axum with Basic Auth

An Out Of Bounds Read occurs when a program reads memory outside the intended buffer, potentially exposing sensitive data or leading to information disclosure. In Axum, this risk can emerge when HTTP request handling interacts with unsafe data access patterns and authentication logic. When Basic Auth is used, credentials are typically extracted from the Authorization header, decoded from Base64, and parsed into username and password. If the parsing logic does not rigorously validate string lengths and memory boundaries, an attacker may supply an overly long or malformed credential string that causes reads beyond allocated buffers.

Consider a scenario where the application manually decodes the header and splits on the colon without length checks:

let auth_header = request.headers().get("authorization")?.to_str()?;
if let Some(credentials) = auth_header.strip_prefix("Basic ") {
    let decoded = general_purpose::STANDARD.decode(credentials)?;
    let decoded_str = String::from_utf8(decoded)?;
    let mut parts = decoded_str.splitn(2, ':');
    let user = parts.next().unwrap_or("");
    let pass = parts.next().unwrap_or("");
    // proceed with validation
}

If the decoded payload contains an extremely long username or password, the split or string operations may create slices that reference memory outside the intended buffer, depending on how the runtime manages underlying byte arrays. While Rust’s safety features generally prevent direct memory access, an Out Of Bounds Read can still manifest through unsafe code or subtle logic errors in downstream libraries that process these strings. The impact is typically information disclosure, where adjacent memory contents might be leaked through error messages or timing differences.

middleBrick detects such patterns during black-box scanning by sending long and malformed Basic Auth credentials and observing responses for inconsistencies, crashes, or data exposure. The tool examines whether the API returns 500 errors, inconsistent timing, or partial data that could indicate memory irregularities. Because the scan is unauthenticated, it focuses on the public surface exposed by the endpoint, including how it handles malformed headers and unexpected input lengths.

When combined with other checks, such as Input Validation and Data Exposure, an Out Of Bounds Read in this context highlights a lack of strict boundary enforcement. Attackers might probe for sensitive information in adjacent memory, and although Axum’s safe abstractions reduce risk, improper handling of decoded credentials can still open avenues for unintended reads. Ensuring that all credential parsing routines enforce strict length limits and avoid unchecked indexing is essential to mitigate this class of vulnerability.

To prevent Out Of Bounds Read and related issues in Axum with Basic Auth, enforce strict validation and avoid unsafe parsing patterns. Always rely on well-maintained libraries for credential extraction and validation, and ensure that decoded values are checked for length and format before use.

The following example demonstrates a robust approach using the basic_auth crate, which safely parses the Authorization header and enforces length constraints:

use axum::{
    async_trait, body::RequestBody, extract::FromRequest, http::request::Parts, response::IntoResponse,
};
use basic_auth::BasicAuth;
use std::convert::Infallible;

struct Authenticated {
    username: String,
    password: String,
}

#[async_trait]
impl FromRequest for Authenticated
where
    S: Send + Sync,
{
    type Rejection = impl IntoResponse;

    async fn from_request(req: &mut axum::extract::RequestParts) -> Result {
        let headers = req.headers();
        let auth_value = headers
            .get("authorization")
            .and_then(|v| v.to_str().ok())
            .ok_or_else(|| (axum::http::StatusCode::UNAUTHORIZED, "Missing or invalid header"))?;

        let auth = BasicAuth::parse(auth_value)
            .map_err(|_| (axum::http::StatusCode::UNAUTHORIZED, "Invalid authorization format"))?;

        if auth.user_id().len() > 256 || auth.password().len() > 256 {
            return Err((axum::http::StatusCode::UNAUTHORIZED, "Credential length exceeds limit").into_response());
        }

        // Here you would verify credentials against a secure store
        if auth.user_id() == "valid_user" && auth.password() == "valid_password" {
            Ok(Authenticated {
                username: auth.user_id().to_string(),
                password: auth.password().to_string(),
            })
        } else {
            Err((axum::http::StatusCode::UNAUTHORIZED, "Invalid credentials").into_response())
        }
    }
}

async fn handler(Authenticated { username, password }: Authenticated) -> impl IntoResponse {
    format!("Authenticated as: {}", username)
}