Prototype Pollution in Axum with Mutual Tls

Prototype pollution in Axum with Mutual TLS (mTLS) arises when an API accepts untrusted input that flows into object construction or modification paths, even though mTLS provides strong transport-layer identity verification. mTLS ensures the client presenting a certificate is known, but it does not constrain how the server deserializes or merges incoming JSON, query parameters, or header values into Rust structures. If application code merges user-controlled data into shared or prototype objects before validation, an authenticated client with a valid certificate can supply crafted fields that modify object prototypes or class templates, leading to unexpected behavior.

In Axum, handlers often deserialize request bodies into serde_json::Value or custom structs. When using recursive merging, dynamic insertion, or update patterns that apply partial updates, fields such as __proto__, constructor.prototype, or other meta-properties can be introduced. Even with mTLS, if authorization checks are performed after deserialization and rely on mutated state (e.g., roles or scopes added via pollution), an authenticated client can escalate privileges or bypass intended constraints. For example, a handler that merges a user-supplied patch into a base configuration map may inadvertently add or overwrite keys used elsewhere in the request lifecycle, including rate-limiting contexts or permission caches.

The combination of mTLS and prototype pollution is notable because mTLS reduces the attack surface to authenticated entities, raising the bar for who can trigger the flaw, but it does not eliminate logic flaws in data handling. An attacker who possesses a valid certificate—obtained through compromise, social engineering, or misconfigured issuance—can still probe endpoints for merge-based pollution. Because Axum applications commonly share configuration or state across handlers, polluted prototypes can affect multiple routes, amplifying impact. Standard input validation libraries and schema validators help, but developers must explicitly reject or sanitize meta-fields and avoid in-place merging of untrusted data to prevent prototype pollution in this authenticated context.

To mitigate prototype pollution in Axum with mTLS, design handlers to avoid mutable merging of untrusted data and explicitly validate all input fields. Use strict deserialization schemas that reject unknown fields and meta-properties, and apply transformations after validation rather than before. mTLS should be enforced at the router or extractor level, ensuring requests carry valid certificates before any business logic runs, but validation must still treat authenticated data as untrusted.

Example of an Axum handler with mTLS configured via tower-rs and hyper-native-tls (conceptual high-level setup) and safe deserialization using serde:

use axum::{routing::post, Router};
use serde::Deserialize;
use std::net::SocketAddr;

#[derive(Deserialize)]
struct SafeInput {
    #[serde(deny_unknown_fields)]
    username: String,
    #[serde(deny_unknown_fields)]
    role: String,
}

async fn create_user_handler(input: axum::Json) -> String {
    // Business logic uses validated, fixed schema — no dynamic merging
    format!("User {} with role {}", input.username, input.role)
}

#[tokio::main]
async fn main() {
    let app = Router::new().route("/users", post(create_user_handler));
    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
    // In practice, mTLS is enforced by the HTTPS acceptor (e.g., hyper with rustls)
    axum::Server::bind(&addr)
        .https(hyper_rustls::HttpsAcceptor::new(
            rustls::ServerConfig::builder()
                .with_safe_defaults()
                .with_client_auth_cert(vec![], rustls::NoClientAuth::new()) // configure client CA in real use
                .unwrap(),
        ))
        .serve(app.into_make_service())
        .await
        .unwrap();
}

Key practices:

• Use #[serde(deny_unknown_fields)] to prevent extra keys that could include prototype-like fields.
• Avoid recursive merge or patch operations on serde_json::Value with untrusted data; prefer replacing with validated structures.
• Apply mTLS at the transport layer via a secure HTTPS acceptor, ensuring only clients with valid certificates reach handlers, while still validating input content.
• Do not derive roles or permissions from deserialized user-provided fields; map authenticated certificate identities to permissions server-side.

With the middleBrick CLI, you can verify that your endpoints reject unexpected fields even when mTLS is enforced: middlebrick scan <url>. In Pro plans, continuous monitoring can detect regressions in input validation rules across deployments, and the GitHub Action can gate CI/CD if a scan exceeds your risk threshold.