Beast Attack in Axum with Mutual Tls

A Beast Attack (Browser Exploit Against SSL/TLS) targets block ciphers in TLS 1.0 and early TLS 1.1, where an attacker can decrypt ciphertext by observing changes in an adjacent record’s plaintext. In Axum, enabling Mutual TLS (mTLS) means the server requests and validates client certificates, but does not inherently change the cipher suite negotiation that occurs between the Rust TLS layer and the client. If the negotiated cipher is a block cipher (e.g., using TLS_RSA_WITH_AES_128_CBC_SHA) and the server processes requests in a way that reflects plaintext differences or timing, a Beast-like scenario can be constructed: an attacker can inject a malicious script in one request and observe side effects in a subsequent request within the same session, leveraging predictable IV handling in CBC-mode records.

When mTLS is enabled, the server verifies the client certificate before application logic runs. However, if the application routes the authenticated identity into business logic that changes response behavior (e.g., returning different content or headers based on certificate fields), an attacker may chain certificate-based authentication with a Beast-style oracle on record boundaries. The combination of mTLS and a vulnerable ordering of record encryption (where application messages are not properly separated or padded) can expose information across requests. Axum’s typical use of hyper with native-tls or rustls means the cipher suite is negotiated at the TLS layer; if rustls is configured to prefer CBC suites (or does not disable them in favor of AEAD), the server remains susceptible. This is not a flaw in Axum per se, but a consequence of depending on legacy ciphers and failing to enforce AEAD-only configurations.

An illustrative request flow: a client with a valid mTLS certificate sends a POST to /transfer with a JSON body containing an amount. The server processes this, sets a session cookie, and returns 200. An attacker, able to inject a malicious fragment via an unsafe endpoint (e.g., a reflected input), can then craft a series of requests where the IV of one record influences the decryption of the next. If the server’s response varies based on the presence of a valid client certificate (which mTLS enforces), the attacker gains an oracle to infer plaintext. This underscores the importance of enforcing AEAD ciphers and ensuring that certificate-bound state does not leak into side channels that a Beast attack could exploit.

To mitigate Beast-related risks in Axum with Mutual TLS, focus on disabling weak ciphers and enforcing AEAD-based cipher suites, while ensuring certificate-bound state does not introduce side channels. Below are concrete, syntactically correct examples using rustls, which is the common choice for mTLS in Axum.

1. Configure rustls server with AEAD-only cipher suites and client certificate verification:

use axum::Router;
use std::net::SocketAddr;
use rustls::{Certificate, PrivateKey, ServerConfig};
use rustls::pki_types::{CertificateDer, PrivateKeyDer};
use std::sync::Arc;

async fn make_router() -> Router {
    // Define your routes here
    Router::new()
}

#[tokio::main]
async fn main() {
    let cert = load_certs("cert.pem");
    let key = load_private_key("key.pem");
    let client_ca = load_client_certs("client-ca.pem");

    let mut config = ServerConfig::builder()
        .with_safe_defaults()
        .with_no_client_auth() // we will set client auth below
        .with_single_cert(cert, key)
        .expect("valid cert and key");

    // Require client certificates for mTLS
    config.client_auth_root_subjects = client_ca.into_iter().map(|c| c.subject).collect();
    config.client_auth = Arc::new(|_endpoints| Ok(rustls::server::ClientAuth::Required));

    // Enforce AEAD-only: disable CBC and other non-AEAD ciphers via cipher suite selection
    config.ciphersuites = vec![
        rustls::cipher_suite::TLS13_AES_256_GCM_SHA384,
        rustls::cipher_suite::TLS13_CHACHA20_POLY1305_SHA256,
        rustls::cipher_suite::TLS12_AES_256_GCM_SHA384,
        rustls::cipher_suite::TLS12_AES_128_GCM_SHA256,
    ]
    .into_iter()
    .collect();

    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
    let listener = tokio::net::TcpListener::bind(addr).await.unwrap();
    let app = make_router();

    axum::serve(
        listener,
        app.into_make_service_with_connect_info::(),
    )
    .tls_config(rustls::TlsAcceptor::from(Arc::new(config)))
    .unwrap()
    .await
    .unwrap();
}

fn load_certs(path: &str) -> Vec<CertificateDer<'static>> {
    rustls_pemfile::certs(&mut std::io::BufReader::new(std::fs::File::open(path).unwrap())).unwrap()
}

fn load_private_key(path: &str) -> PrivateKeyDer<'static> {
    let mut reader = std::io::BufReader::new(std::fs::File::open(path).unwrap());
    let keys = rustls_pemfile::pkcs8_private_keys(&mut reader).unwrap();
    keys.into_iter().next().unwrap().into()
}

2. If using native-tls (less common for mTLS in modern Rust), prefer upgrading to rustls or ensure the native-tls backend does not negotiate CBC suites; however, rustls is recommended for fine-grained control.

3. Ensure that application logic does not use the client certificate fingerprint or subject as a sole authorization token without additional validation; treat mTLS as transport-layer authentication and enforce authorization checks in your handlers to prevent indirect side channels that could be leveraged in conjunction with a Beast attack.