Regex Dos in Axum with Basic Auth

Axum applications that use HTTP Basic Authentication and rely on regular expressions to validate or extract credentials can be exposed to ReDoS (Regular Expression Denial of Service) when patterns are not carefully constrained. ReDoS occurs when a crafted input causes catastrophic backtracking, consuming excessive CPU time and making the service unresponsive. This section explains how Axum route design, extractor usage, and regex-heavy validation intersect with Basic Auth to create exploitable conditions.

Basic Authentication conveys credentials in the Authorization header as Basic base64(username:password). In Axum, handlers often decode this header and apply custom logic or regex to validate format, permitted characters, or structure. For example, a developer might use a regex to ensure usernames and passwords contain only a restricted character set, or to parse legacy formats embedded in credentials. When these regexes are applied to attacker-controlled input (the decoded username or password), problematic patterns—such as nested quantifiers or ambiguous groupings—can be triggered by specially crafted strings.

Consider a route that decodes the Basic Auth header and validates credentials with a permissive character class and a quantifier that overlaps. A pattern like ^[a-zA-Z0-9_]*:.*$ applied to the decoded payload can exhibit exponential backtracking when the input contains long sequences of characters that satisfy [a-zA-Z0-9_]* while the engine attempts many ways to satisfy the ambiguous .* that follows. In Axum, this typically occurs inside extractor implementations or guard closures that synchronously evaluate regexes on each request. Because scans performed by middleBrick include checks for Input Validation and Unsafe Consumption, such patterns can be surfaced as high-severity findings when the runtime behavior indicates a risk of resource exhaustion.

Another common scenario involves repeated optional groups or nested quantifiers in patterns used to enforce policy (for example, matching a username with optional segments like ^(?:user|admin|guest)(?:-v\d+)?$ combined with permissive suffix matching). When combined with Basic Auth, an attacker can send credentials designed to maximize backtracking paths, especially if the regex is applied repeatedly per request or within middleware that processes many headers. Because middleBrick’s checks include Input Validation and Rate Limiting, findings may highlight both the regex risk and the absence of adequate request throttling, which together amplify the availability impact.

To illustrate the mechanics, a vulnerable Axum extractor might look like the following Rust code. Note that this pattern is intentionally fragile to demonstrate the issue; the quantifier ambiguity and open-ended character classes create conditions suitable for ReDoS when the decoded credential is controlled by an attacker.

use axum::{{
    async_trait,
    extract::{FromRequest, Request},
    http::request::Parts,
}};
use regex::Regex;
use std::convert::Infallible;

struct BasicCredentials { pub username: String, pub password: String }

#[async_trait]
impl FromRequest<S> for BasicCredentials
where
    S: Send + Sync,
{
    type Rejection = Infallible;

    async fn from_request(req: Request, _state: &S) -> Result<Self, Self::Rejection> {
        let header = req.headers().get("authorization")
            .and_then(|v| v.to_str().ok())
            .unwrap_or("");
        if let Some(creds) = header.strip_prefix("Basic ") {
            if let Ok(decoded) = base64::decode(creds) {
                if let Ok(pair) = String::from_utf8(decoded) {
                    // Vulnerable regex: overlapping quantifiers and permissive character class
                    let re = Regex::new(r"^([a-zA-Z0-9_]*):(.*)$").ok();
                    if let Some(r) = re {
                        if let Some(caps) = r.captures(&pair) {
                            let _user = caps.get(1).map(|m| m.as_str().to_string());
                            let _pass = caps.get(2).map(|m| m.as_str().to_string());
                        }
                    }
                }
            }
        }
        // Fallback to default rejection handling in real code
        Result::Ok(BasicCredentials { username: String::new(), password: String::new() })
    }
}