Double Free in Aspnet with Hmac Signatures

In ASP.NET applications, a Double Free scenario can emerge when HMAC-based signature validation is implemented inconsistently across components or across different versions of the same API. This typically occurs when a developer validates an HMAC signature on incoming requests in one layer (for example, a middleware or filter) and then passes the same payload or signature to another component that also performs validation, potentially triggering a second deallocation or second processing pass on internal structures that assume single ownership.

When using HMAC signatures, the process involves computing a hash-based message authentication code over the request payload and comparing it to a signature provided by the client. If the comparison logic is duplicated—for instance, once in model binding and again in a custom authorization filter—the runtime may attempt to free or release resources associated with the signature or payload multiple times. This can happen if one validation step consumes or mutates a shared buffer and a second step operates on the same memory without guarding against re-entrancy or re-processing.

ASP.NET’s model binding and input formatters can inadvertently contribute to this pattern. For example, when using FromBody with a complex type that includes a signature property, the framework may deserialize the payload and later pass the same stream or byte array to custom logic that recomputes and verifies the HMAC. If both the framework and the custom logic attempt to read or dispose of the underlying stream, a double-free condition can manifest, especially if native resources or pinned memory are involved indirectly through dependencies.

Another vector involves signature reuse across multiple validation stages. Consider an API that first validates the HMAC at the edge via middleware and then again inside a controller action or a service. If the middleware removes or marks the signature as consumed but the controller still attempts to validate it, the underlying buffers might be accessed after being freed. This is particularly risky when developers use helper methods that assume exclusive access or when they cache normalized request data without accounting for lifecycle ownership.

Attackers can exploit this by sending carefully crafted requests that trigger both validation paths. While the vulnerability is not a remote code execution flaw in the HMAC algorithm itself, it can lead to crashes, denial of service, or unpredictable behavior that may be chained with other weaknesses. In security-focused testing with middleBrick, such patterns can appear under BFLA/Privilege Escalation or Unsafe Consumption checks, where duplicated authorization logic and input handling are flagged.

Using tools like middleBrick’s OpenAPI/Swagger analysis, which resolves $ref definitions and cross-references spec definitions with runtime behavior, can help identify duplicated validation steps. The scanner runs 12 security checks in parallel and can surface inconsistencies in how HMAC signatures are handled across endpoints, providing prioritized findings with severity and remediation guidance without requiring credentials or agent installation.

To remediate Double Free risks when using HMAC signatures in ASP.NET, ensure that signature validation occurs in a single, well-defined location and that resources are not accessed multiple times. Centralize the verification logic and avoid redundant checks across middleware, filters, and controller code.

Example 1: Single Validation via Middleware

Implement HMAC validation in a custom middleware that runs early in the pipeline and sets a flag to prevent downstream re-validation. Use a memory stream that is carefully managed to avoid multiple reads or disposal attempts.

using System.Security.Cryptography;
using System.Text;
using Microsoft.AspNetCore.Http;

public class HmacValidationMiddleware
{
    private readonly RequestDelegate _next;
    private readonly byte[] _secretKey;

    public HmacValidationMiddleware(RequestDelegate next, byte[] secretKey)
    {
        _next = next;
        _secretKey = secretKey;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        // Only validate when the HMAC header is present
        if (context.Request.Headers.TryGetValue("X-API-Signature", out var signatureHeader))
        {
            using var memoryStream = new MemoryStream();
            await context.Request.Body.CopyToAsync(memoryStream);
            var bodyBytes = memoryStream.ToArray();

            // Compute HMAC
            string computedSignature;
            using (var hmac = new HMACSHA256(_secretKey))
            {
                var hash = hmac.ComputeHash(bodyBytes);
                computedSignature = Convert.ToBase64String(hash);
            }

            // Constant-time comparison to avoid timing attacks
            if (!CryptographicOperations.FixedTimeEquals(
                Encoding.UTF8.GetBytes(computedSignature),
                Encoding.UTF8.GetBytes(signatureHeader)))
            {
                context.Response.StatusCode = 401;
                return;
            }

            // Replace the body stream so downstream code can read it safely
            context.Request.Body = new MemoryStream(bodyBytes);
            context.Items["HmacValidated"] = true;
        }

        await _next(context);
    }
}

Example 2: Controller-Level Guard with Validation Flag

In the controller, check the flag set by middleware before re-verifying or processing the signature. Avoid re-computing the HMAC unless necessary, and ensure no duplicate stream disposal occurs.

[ApiController]
[Route("api/[controller]")]
public class OrdersController : ControllerBase
{
    [HttpPost]
    public IActionResult CreateOrder([FromBody] OrderRequest request)
    {
        // Skip validation if already handled by middleware
        if (!HttpContext.Items.TryGetValue("HmacValidated", out var validated) || !(bool)validated)
        {
            return Unauthorized("Missing or invalid HMAC.");
        }

        // Proceed with business logic
        return Ok(new { OrderId = Guid.NewGuid() });
    }
}

public class OrderRequest
{
    public string ProductId { get; set; }
    public int Quantity { get; set; }
    // Signature property is not required here to avoid double processing
}

Example 3: Using IActionFilter for Controlled Validation

Alternatively, use an action filter to enforce single validation and prevent accidental re-checks in actions that should not require per-request signature verification.

public class ValidateHmacAttribute : TypeFilterAttribute
{
    public ValidateHmacAttribute() : base(typeof(HmacFilter))
    {
    }

    private class HmacFilter : IActionFilter
    {
        private readonly byte[] _secretKey;

        public HmacFilter(IConfiguration configuration)
        {
            _secretKey = Convert.FromBase64String(configuration["Hmac:SecretKey"]);
        }

        public void OnActionExecuting(ActionExecutingContext context)
       {
            if (!context.HttpContext.Request.Headers.TryGetValue("X-API-Signature", out var signature))
            {
                context.Result = new UnauthorizedResult();
                return;
            }

            using var ms = new MemoryStream();
            context.HttpContext.Request.Body.CopyTo(ms);
            var body = ms.ToArray();

            using var hmac = new HMACSHA256(_secretKey);
            var computed = hmac.ComputeHash(body);
            var expected = Convert.ToBase64String(computed);

            if (!CryptographicOperations.FixedTimeEquals(Encoding.UTF8.GetBytes(expected), Encoding.UTF8.GetBytes(signature)))
            {
                context.Result = new UnauthorizedResult();
            }
            else
            {
                // Restore the stream for downstream use
                context.HttpContext.Request.Body = new MemoryStream(body);
                context.HttpContext.Items["HmacValidated"] = true;
            }
        }

        public void OnActionExecuted(ActionExecutedContext context)
        {
            // No additional validation needed
        }
    }
}

These examples emphasize a single source of truth for HMAC validation, careful stream management, and avoiding duplicated processing. They align with security practices that reduce risks such as Double Free and are supported by middleBrick’s checks for BFLA/Privilege Escalation and Unsafe Consumption when scanning APIs.