Zone Transfer in Axum with Basic Auth

A zone transfer is a DNS protocol operation where a secondary nameserver retrieves a full copy of a zone file from a primary nameserver. In an Axum-based service, if a DNS server or a custom Axum endpoint exposes a zone transfer route and relies solely on HTTP Basic Authentication for access, the combination can create a significant information leak. Basic Authentication transmits credentials as a base64-encoded string in the Authorization header, which is easily decoded if intercepted. When a zone transfer endpoint is protected only by Basic Auth without additional network-level restrictions, an unauthenticated or low-privilege attacker who can observe or guess the endpoint may enumerate DNS records, internal hostnames, IP ranges, and infrastructure topology.

From a security assessment perspective, middleBrick scans this attack surface by running 12 security checks in parallel, including Authentication, BOLA/IDOR, and Data Exposure. When a zone transfer endpoint in Axum is reachable without additional controls and is protected only by Basic Auth, the scan can detect the absence of proper authorization controls and the presence of overly permissive CNAME or AXFR endpoints. Even without credentials, certain implementations may inadvertently allow zone transfers due to misconfigured access controls or lack of source IP restrictions. The scanner evaluates whether the endpoint exposes sensitive DNS data and maps findings to frameworks such as OWASP API Top 10 and PCI-DSS, highlighting insecure direct object references and missing property-level authorization.

An example of a vulnerable Axum handler that accepts zone transfer requests without enforcing strict access controls is shown below. This route uses Basic Auth for credential validation but does not restrict the operation to authorized secondary servers or validate the zone requested. The handler parses the Authorization header, decodes the credentials, and proceeds with the transfer if a user is present, regardless of IP or scope checks.

use axum::{
    async_trait,
    extract::{self, Request},
    http::{
        header::{AUTHORIZATION, HeaderMap},
        StatusCode,
    },
    response::IntoResponse,
    Extension,
};
use std::convert::Infallable;
use base64::Engine;

async fn handle_axfr(
    headers: HeaderMap,
    Extension(router): Extension<RouterState>,
) -> Result<impl IntoResponse, (StatusCode, String)> {
    let auth_header = headers.get(AUTHORIZATION)
        .ok_or((StatusCode::UNAUTHORIZED, "Missing Authorization header".to_string()))?;
    let auth_str = auth_header.to_str().map_err(|_| (StatusCode::UNAUTHORIZED, "Invalid header encoding".to_string()))?;
    if !auth_str.starts_with("Basic ") {
        return Err((StatusCode::UNAUTHORIZED, "Unsupported authentication scheme".to_string()));
    }
    let encoded = auth_str.trim_start_matches("Basic ");
    let decoded = base64::engine::general_purpose::STANDARD.decode(encoded)
        .map_err(|_| (StatusCode::UNAUTHORIZED, "Invalid base64".to_string()))?;
    let credentials = String::from_utf8(decoded).map_err(|_| (StatusCode::UNAUTHORIZED, "Invalid UTF-8".to_string()))?;
    let parts: Vec<&str> = credentials.splitn(2, ':').collect();
    if parts.len() != 2 {
        return Err((StatusCode::UNAUTHORIZED, "Invalid credentials format".to_string()));
    }
    let (user, _pass) = (parts[0], parts[1]);
    // Missing: IP allowlist, zone validation, rate limiting
    let zone = router.zones.get(user).cloned().unwrap_or_default();
    Ok((StatusCode::OK, zone))
}

In this example, the route trusts the authenticated user name to determine which zone to return, effectively allowing a low-privilege authenticated user to request any zone if the mapping is weak. If an attacker can authenticate with valid credentials (e.g., via credential stuffing or weak passwords), they can iterate over known zone names and harvest internal DNS data. middleBrick detects such patterns by correlating authentication requirements with observable endpoint behavior and flags missing property-level authorization and excessive data exposure.

To remediate zone transfer risks in Axum when using Basic Auth, apply defense-in-depth measures: enforce IP allowlisting for secondary servers, validate the requested zone against an explicit allowlist, and avoid exposing zone mappings via user-controlled identifiers. Basic Auth should be treated as a transport-level guard rather than an authorization mechanism for sensitive operations. Combine it with network controls and strict parameter validation.

Below is a hardened example that introduces an IP allowlist and explicit zone validation. The handler checks the source IP against a predefined list of allowed secondary server addresses and ensures the requested zone matches an expected zone name before returning any data. This prevents enumeration and unauthorized transfers even if credentials are compromised.

use axum::{
    async_trait,
    extract::{self, Request},
    http::{
        header::{AUTHORIZATION, HeaderMap},
        StatusCode,
    },
    response::IntoResponse,
    Extension,
};
use std::convert::Infallable;
use base64::Engine;

async fn handle_axfr(
    headers: HeaderMap,
    remote_addr: extract::ConnectInfo<std::net::SocketAddr>,
    Extension(router): Extension<RouterState>,
) -> Result<impl IntoResponse, (StatusCode, String)> {
    let auth_header = headers.get(AUTHORIZATION)
        .ok_or((StatusCode::UNAUTHORIZED, "Missing Authorization header".to_string()))?;
    let auth_str = auth_header.to_str().map_err(|_| (StatusCode::UNAUTHORIZED, "Invalid header encoding".to_string()))?;
    if !auth_str.starts_with("Basic ") {
        return Err((StatusCode::UNAUTHORIZED, "Unsupported authentication scheme".to_string()));
    }
    let encoded = auth_str.trim_start_matches("Basic ");
    let decoded = base64::engine::general_purpose::STANDARD.decode(encoded)
        .map_err(|_| (StatusCode::UNAUTHORIZED, "Invalid base64".to_string()))?;
    let credentials = String::from_utf8(decoded).map_err(|_| (StatusCode::UNAUTHORIZED, "Invalid UTF-8".to_string()))?;
    let parts: Vec<&str> = credentials.splitn(2, ':').collect();
    if parts.len() != 2 {
        return Err((StatusCode::UNAUTHORIZED, "Invalid credentials format".to_string()));
    }
    let (_user, _pass) = (parts[0], parts[1]);

    // Enforce IP allowlist for secondary servers
    let allowed_ips = ["192.0.2.10", "198.51.100.20"];
    if !allowed_ips.contains(&remote_addr.ip().to_string().as_str()) {
        return Err((StatusCode::FORBIDDEN, "IP not allowed for zone transfers".to_string()));
    }

    // Validate requested zone explicitly
    let requested_zone = router.zone_param_from_request(&headers)
        .map_err(|_| (StatusCode::BAD_REQUEST, "Missing or invalid zone parameter".to_string()))?;
    let allowed_zones = ["example.com", "internal.example.com"];
    if !allowed_zones.contains(&requested_zone.as_str()) {
        return Err((StatusCode::FORBIDDEN, "Zone not authorized for transfer".to_string()));
    }

    let zone = router.zones.get(requested_zone).cloned().unwrap_or_default();
    Ok((StatusCode::OK, zone))
}

These changes ensure that zone transfers are restricted to known secondary IPs and that only predefined zones can be exported. middleBrick can validate such configurations by scanning the endpoint and checking for missing authorization constraints, excessive data exposure, and weak authentication practices. For ongoing protection, use the middleBrick Pro plan to enable continuous monitoring and receive alerts if the risk score changes, or integrate the GitHub Action to fail builds when scans exceed your defined thresholds.