Buffer Overflow in Phoenix with Mutual Tls

A buffer overflow occurs when a program writes more data to a buffer than it can hold, corrupting adjacent memory. In the context of a Phoenix application served with Mutual TLS (mTLS), the TLS layer handles encryption and client certificate validation before requests reach your Phoenix endpoints. If your Phoenix code does not adequately validate the size of data derived from client-supplied headers, cookies, or request body, an attacker can still trigger oversized payloads that overflow internal buffers. Even with mTLS ensuring the client is authenticated, the authenticated client can send maliciously large or malformed inputs that exploit unchecked string concatenation, binary parsing, or improper handling of binary data in Elixir or in linked C components via NIFs or ports.

Mutual TLS in Phoenix typically involves configuring the web server (e.g., Cowboy) to require client certificates and passing verified certificate details into your request handling pipeline, often via Plug or custom connection assigns. This setup reduces risk from unauthenticated senders but does not remove the need to validate input size and format. For example, a client certificate may be accepted, but the request body or headers it sends can still contain oversized JSON, multipart form data, or deeply nested structures that, when processed by Elixir or Erlang runtime, lead to excessive memory growth or binary copying that exceeds intended buffer boundaries. Common vulnerable patterns include using Plug.Parsers without size limits, concatenating binaries in loops, or decoding large binaries without boundary checks.

Real-world attack patterns mirror classic OWASP API Top 10 risks such as Improper Input Validation and Memory Safety Issues. A crafted request with an extremely large header or body can trigger a crash, leading to denial of service or, in rare cases involving NIFs or external drivers, potential code execution. Because mTLS confirms identity, the attacker may be a trusted but malicious client, making robust input validation and size limits even more critical. The scanner checks will flag missing size constraints on parsers, unchecked binary handling, and missing backpressure controls as high-severity findings.

Example of a vulnerable Phoenix pipeline without size controls:

defmodule MyAppWeb.Router do
  use MyAppWeb, :router

  pipeline :api do
    plug :accepts, ["json"]
    # Missing Plug.Parsers limit or validation
  end

  scope "/api", MyAppWeb do
    pipe_through :api
    post "/upload", UploadController, :create
  end
end

An attacker authenticated via mTLS can POST a large JSON payload to /api/upload, causing the system to allocate large binaries and potentially overflow internal buffers used by the runtime or linked libraries.

To mitigate buffer overflow risks in Phoenix with Mutual TLS, apply strict input validation and size limits at the pipeline and handler level, and ensure binary handling is safe. Configure Cowboy to enforce reasonable limits and use Plug parsers with explicit size constraints. Validate and limit the size of all client-supplied data, including headers and body, regardless of mTLS status.

Secure pipeline example with size controls and mTLS-derived metadata:

defmodule MyAppWeb.Router do
  use MyAppWeb, :router

  # Enforce request size limits early in the pipeline
  plug Plug.Parsers,
    parsers: [:urlencoded, :multipart, :json],
    pass: ["*/*"],
    json_decoder: Jason,
    max_memory: 1_000_000,          # 1 MB max memory for parsed body parts
    max_length: 10_000_000           # 10 MB max total request length

  pipeline :mtls_protected do
    plug :verify_client_cert
    plug :assign_client_from_cert
    plug :validate_request_size
  end

  scope "/api", MyAppWeb do
    pipe_through [:mtls_protected, :api]
    post "/upload", UploadController, :create
  end

  # Verify client certificate and extract subject/issuer into connection assigns
  defp verify_client_cert(conn, _opts) do
    case conn.client_cert do
      nil ->
        # Reject if no client cert presented under mTLS requirement
        Plug.Conn.send_resp(conn, 400, "Client certificate required")
        Plug.Conn.halt(conn)

      cert ->
        # Store verified metadata for downstream use
        subject = :public_key.pkix_decode_cert(cert, :otp) |> :public_key.pkix_name_hash()
        put_assign(conn, :client_subject, subject)
    end
  end

  # Assign client details from verified certificate
  defp assign_client_from_cert(conn, _opts) do
    if assign = conn.assigns[:client_subject] do
      # Example: attach minimal, validated metadata only
      put_assign(conn, :mTLS_verified, true)
    else
      conn
    end
  end

  # Enforce additional size checks at the handler or plug level
  defp validate_request_size(conn, _opts) do
    content_length =
      conn.req_headers
      |> Enum.find_value(fn {"content-length", val} -> String.to_integer(val) rescue nil end)

    if content_length && content_length > 10_000_000 do
      Plug.Conn.send_resp(conn, 413, "Request body too large")
      Plug.Conn.halt(conn)
    else
      conn
    end
  end
end

Handler-safe binary processing example:
defmodule MyAppWeb.UploadController do
  use MyAppWeb, :controller

  def create(conn, %{"file" => file}) do
    # Use binary part size checks and avoid unbounded concatenation
    if byte_size(file) > 5_000_000 do
      conn
      |> Plug.Conn.send_resp(413, "File too large")
      |> Plug.Conn.halt()
    else
      # Process in chunks or validate content type/size before full consumption
      safe_process(file)
      json(conn, %{status: "ok"})
    end
  end

  defp safe_process(binary) when is_binary(binary) do
    # Avoid repeated binary concatenation in loops; use IO binaries or binaries:part/2
    :ok
  end
end

These configurations ensure that even with authenticated mTLS clients, the application enforces strict size boundaries, preventing buffer overflow conditions. The scanner will verify the presence of such limits and flag missing constraints.