Container Escape in Axum with Api Keys

A container escape in an Axum-based service becomes critical when API keys are used for routing or authorization without additional validation. Axum is a web framework for Rust that encourages explicit routing and extractor-based handling. If API keys are accepted only as raw strings and then used to make privilege or routing decisions without proper authorization checks, an attacker may leverage a misconfigured route to perform a container escape. This typically occurs when key validation is applied at a high level (e.g., middleware) but not enforced on each sensitive handler, or when debug or administrative endpoints are accidentally exposed in production builds.

For example, an Axum application might define a middleware that checks for a valid API key and stores a claim in request extensions. If a route like /admin/execute relies solely on this extension without re-verifying scope or role, an attacker who discovers or guesses the route can invoke it directly, potentially triggering unsafe operations that interact with the host container. In a containerized deployment, this could allow probing of internal endpoints, access to host metadata services, or execution of binaries mounted into the container, leading to container escape.

Another scenario involves OpenAPI/Swagger definitions where API key security schemes are declared but not fully enforced at the handler level. A scan using middleBrick can detect whether routes requiring keys also implement proper authorization checks and whether sensitive operations are isolated from unauthenticated attack surfaces. Because Axum applications often compose extractors and guards dynamically, missing guards on a single route can negate broader protections, making the unauthenticated attack surface larger than expected.

Real-world attack patterns such as path traversal, SSRF, or probing of internal Kubernetes endpoints can chain with weak API key enforcement to escalate impact. middleBrick’s checks for authentication, BOLA/IDOR, and property authorization help identify these gaps by correlating spec definitions with runtime behavior, highlighting routes where keys are accepted but not properly scoped.

To remediate container escape risks tied to API keys in Axum, enforce authorization at the handler level, validate key scope, and avoid relying on request extensions alone for privilege decisions. Below are concrete code examples demonstrating secure patterns.

1. Explicit key validation per handler

Instead of trusting middleware-extracted claims, validate the key within each sensitive handler or use a guarded extractor that re-checks scope.

use axum::{
    async_trait,
    extract::{FromRequest, Request},
    response::IntoResponse,
    Extension, Json,
};
use std::convert::Infallible;

struct ApiKey(String);

#[async_trait]
impl FromRequest<S> for ApiKey
where
    S: Send + Sync,
{
    type Rejection = (axum::http::StatusCode, &'static str);

    async fn from_request(req: Request, _state: &S) -> Result {
        let key = req.headers()
            .get("X-API-Key")
            .and_then(|v| v.to_str().ok())
            .map(String::from);
        match key {
            Some(k) if validate_key_scope(&k, "admin").await => Ok(ApiKey(k)),
            _ => Err((axum::http::StatusCode::FORBIDDEN, "Invalid or insufficient scope")),
        }
    }
}

async fn admin_handler(Json(payload): Json<serde_json::Value>, ApiKey(key): ApiKey) -> impl IntoResponse {
    // Perform admin action only after per-handler scope validation
    (axum::http::StatusCode::OK, format!("Admin action allowed with key: {}", key))
}

async fn validate_key_scope(key: &str, required_scope: &str) -> bool {
    // Replace with actual key-store lookup and scope check
    key == "valid_admin_key" && required_scope == "admin"
}
"

use axum::{Extension, Json};
use serde::Deserialize;

#[derive(Deserialize)]
struct Operation { kind: String }

async fn safe_operation(
    Extension(user): Extension<User>,
    Json(op): Json<Operation>,
) -> Result<impl IntoResponse, (axum::http::StatusCode, String)> {
    if user.can_perform(&op.kind) {
        Ok((axum::http::StatusCode::OK, format!("Executed {}", op.kind)))
    } else {
        Err((axum::http::StatusCode::FORBIDDEN, "Insufficient permissions".into()))
    }
}

struct User { roles: Vec<String> }

impl User {
    fn can_perform(&self, op: &str) -> bool {
        self.roles.contains(&op.to_string())
    }
}
"

use axum::routing::get;
use axum::Router;

fn app() -> Router {
    let mut router = Router::new();
    if cfg!(debug_assertions) { 
        // Only expose debug endpoints locally
        router = router.route("/debug/exec", get(debug_exec));
    }
    router = router.route("/public/data", get(public_data));
    router
}

async fn debug_exec() -> &'static str { "Dangerous endpoint" }
async fn public_data() -> &'static str { "Safe data" }
"

// Example of ensuring a route requires the "api_key" security scheme
// Declared in OpenAPI as: securitySchemes: { api_key: { type: apiKey, in: header, name: X-API-Key } }
// Axum route should enforce the same requirement via extractor/guard.
"