Brute Force Attack in Axum with Cockroachdb

A brute force attack against an Axum application using CockroachDB as the backend can be amplified by a few characteristics of the stack. When Axum endpoints that authenticate users (for example, a login or password reset route) do not enforce strong rate limiting or account lockout, an attacker can send many credential guesses per second. CockroachDB, while resilient to node failures, does not inherently prevent application-layer abuse; if the Axum service opens a new database connection for each request and performs credential verification in application code, an attacker can drive a high number of queries without triggering infrastructure-level throttling.

Consider an Axum login handler that queries CockroachDB by username to fetch a password hash. If the handler does not enforce per-user or per-IP rate limits and does not use constant-time comparison, an attacker can iterate over passwords rapidly and probe for timing differences or error message variations. Because the scan tests authentication mechanisms and rate limiting as one of the 12 parallel checks, middleBrick can detect whether the endpoint is vulnerable to credential guessing. In distributed CockroachDB deployments, the lack of application-level throttling means requests that would be rate-limited on a single-node database are not automatically curtailed, increasing the risk of successful brute force attempts.

Additionally, if Axum endpoints expose verbose error messages (e.g., “user not found” vs “invalid password”), attackers gain account enumeration advantages that reduce the effort required for brute forcing valid credentials. The absence of per-request randomness (nonces) or replay protections can also enable request replay. Because the scan includes authentication and rate limiting among its checks, it flags cases where Axum routes to CockroachDB do not adequately limit attempts or leak information that facilitates brute force.

Mitigating brute force risk in Axum with CockroachDB centers on enforcing application-side throttling, protecting credential verification logic, and ensuring consistent error handling. Below are concrete, idiomatic examples that you can adapt to your routes.

Rate limiting with a shared store

Use a fast, shared key-value store to track attempts per identifier. The example uses a Redis-backed rate limiter (you can substitute a CockroachDB-backed store if preferred) and integrates cleanly with Axum extractors.

use axum::{
    async_trait, body::Body, extract::FromRequest, http::{Request, StatusCode},
    response::IntoResponse, routing::post, Json, Router,
};
use std::net::SocketAddr;
use std::sync::Arc;
use std::time::Duration;
use reqwest::Client;

struct RateLimiter {
    client: Client,
    redis_url: String,
    max_attempts: u32,
    window_secs: u64,
}

#[async_trait]
impl FromRequest for RateLimiter
where
    S: Send + Sync,
{
    type Rejection = (StatusCode, &'static str);

    async fn from_request(req: &Request, state: &S) -> Result {
        // Simplified; in practice pass config via State.
        Ok(RateLimiter {
            client: Client::new(),
            redis_url: std::env::var("REDIS_URL").unwrap_or_else(|_| "redis://127.0.0.1/".into()),
            max_attempts: 5,
            window_secs: 60,
        })
    }
}

async fn login_handler(
    RateLimiter { client, redis_url, max_attempts, window_secs }: RateLimiter,
    Json(payload): Json,
) -> Result {
    let key = format!("rate_limit:login:{}", payload.username);
    let now = chrono::Utc::now().timestamp();
    let window_start = now - window_secs as i64;

    // Use Redis ZREMRANGEBYSCORE + ZCARD pattern for sliding window.
    let script = r#"
        local key = KEYS[1]
        local now = tonumber(ARGV[1])
        local window = tonumber(ARGV[2])
        local max = tonumber(ARGV[3])
        redis.call('ZREMRANGEBYSCORE', key, 0, now - window)
        local count = redis.call('ZCARD', key)
        if count >= max then
            return 0
        end
        redis.call('ZADD', key, now, now)
        redis.call('EXPIRE', key, window + 10)
        return 1
    "#;

    let res = client
        .query::<(i64,)>(
            &format!("redis://{}/eval", redis_url),
            &[
                &script.to_string(),
                &key,
                &now.to_string(),
                &window_secs.to_string(),
                &max_attempts.to_string(),
            ],
        )
        .await;

    match res {
        Ok(v) if v[0].0 == 0 => return Err((StatusCode::TOO_MANY_REQUESTS, "Too many attempts".into())),
        Err(e) => return Err((StatusCode::INTERNAL_SERVER_ERROR, e.to_string())),
        _ => {}
    }

    // Fetch user from CockroachDB and verify password using a constant-time compare.
    let db_url = std::env::var("COCKROACH_URL").expect("COCKROACH_URL must be set");
    let mut conn = cockroach_client::connect(&db_url).await.map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, "DB error"))?;
    let user: Option = conn
        .query_opt("SELECT id, password_hash, mfa_enabled FROM users WHERE username = $1", &[&payload.username])
        .await
        .map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, "DB error"))?
        .map(|row| UserRecord {
            id: row.get(0),
            password_hash: row.get(1),
            mfa_enabled: row.get(2),
        });

    let user = user.ok_or_else(|| (StatusCode::UNAUTHORIZED, "Invalid credentials".into()))?;
    if !constant_time_compare::verify(&payload.password, &user.password_hash) {
        return Err((StatusCode::UNAUTHORIZED, "Invalid credentials".into()));
    }

    if user.mfa_enabled {
        // Trigger MFA flow...
    }

    Ok(("OK", StatusCode::OK).into_response())
}

#[derive(serde::Deserialize)]
struct LoginPayload {
    username: String,
    password: String,
}

#[tokio::main]
async fn main() {
    let app = Router::new()
        .route("/login", post(login_handler))
        .layer(
            // You can wrap the handler with a tower::Service to reuse RateLimiter from state.
        );
    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
    axum::Server::bind(&addr).serve(app.into_make_service()).await.unwrap();
}

use axum::{http::StatusCode, Json};
use serde::Deserialize;

async fn safe_login_handler(
    Json(payload): Json,
) -> Result)> {
    // Always perform a dummy lookup to keep timing similar.
    let dummy_hash = "$argon2id$v=19$m=65536,t=3,p=4$...";
    let _ = dummy_hash; // placeholder

    // Fetch user (pseudo-code):
    // let user = fetch_user_from_cockroachdb(&payload.username).await;
    // Simulate work to reduce timing variance
    tokio::time::sleep(std::time::Duration::from_millis(50)).await;

    // Do not reveal which part failed.
    Err((StatusCode::UNAUTHORIZED, Json(serde_json::json!({
        "error": "Invalid credentials"
    }))))
}

#[derive(Deserialize)]
struct LoginPayload {
    username: String,
    password: String,
}

use tower::ServiceBuilder;
use tower_http::limit::RateLimitLayer;
use std::time::Duration;

let app = Router::new()
    .route("/login", post(login_handler))
    .layer(
        ServiceBuilder::new()
            .layer(RateLimitLayer::new(
                100, // max requests per window
                Duration::from_secs(1), // window
            ))
    );