Double Free in Axum with Api Keys

A Double Free is a memory safety vulnerability that occurs when a program attempts to free the same dynamically allocated memory more than once. In the context of an Axum application that relies on API keys for client identification or authorization, this can manifest when key material is handled incorrectly across Rust ownership boundaries, especially when integrating with authentication middleware or custom key validation logic.

Consider an Axum handler that receives an API key via header, looks up associated metadata, and stores it in a shared structure such as an Arc<Mutex<HashMap<String, ApiKeyData>>. If the lookup or insertion logic clones the key data and later deallocates the original while also dropping a stale reference elsewhere in user state or a cache, a Double Free can occur. This is exacerbated when unsafe code is used to manage key lifetimes, raw pointers are passed across async boundaries, or reference counts are manipulated without rigorous ownership discipline.

In practice, an attacker could send crafted requests with varying or repeated API keys to trigger edge cases in key parsing or validation code. If the key validation path includes custom deallocation routines or interacts with FFI that frees memory, the repeated free may corrupt the heap. While Axum itself does not directly manage memory, its runtime behavior combined with unsafe key handling libraries can expose this class of vulnerability. The risk is especially relevant when integrating third-party crates that manage key material without clear ownership semantics.

middleBrick’s LLM/AI Security checks include System Prompt Leakage Detection and Active Prompt Injection Testing, which do not apply here, but its scanning of unauthenticated attack surfaces can identify endpoints that expose key-related functionality without proper input validation or rate limiting, indirectly highlighting risky key handling patterns.

To detect such issues, middleBrick runs 12 security checks in parallel, including Input Validation, Authentication, and Unsafe Consumption. These checks correlate OpenAPI/Swagger specs with runtime behavior to surface anomalies in how API keys are accepted and processed, helping to identify endpoints where memory safety bugs like Double Free may be indirectly reachable.

Remediation focuses on safe ownership, avoiding raw pointer manipulation, and ensuring that key material is not freed more than once. Use Rust’s standard smart pointers and Axum’s extractor patterns to manage lifetimes explicitly.

Safe API Key Handling Example

Instead of storing raw pointers or manually managing memory, use Arc to share key metadata safely across handlers:

use axum::{routing::get, Router};
use std::sync::{Arc, Mutex};
use std::collections::HashMap;

struct ApiKeyData {
    key: String,
    scopes: Vec<String>
}

#[tokio::main]
async fn main() {
    let key_store: Arc<Mutex<HashMap<String, ApiKeyData>> = Arc::new(Mutex::new(HashMap::new()));
    // Populate key_store safely at startup
    {
        let mut store = key_store.lock().unwrap();
        store.insert(
            "example_key_123".to_string(),
            ApiKeyData { key: "example_key_123".to_string(), scopes: vec!["read".to_string(), "write".to_string()] }
        );
    }

    let app = Router::new()
        .route("/secure", get(move |headers: axum::extract::Header<axum::http::header::Authorization>| async move {
            let auth_header = headers.into_inner();
            // Validate key safely without manual memory management
            if let Some(key) = auth_header.password().to_str().ok().and_then(|s| if s.starts_with("Bearer ") { Some(&s[7..]) } else { None }) {
                let store = key_store.lock().unwrap();
                if store.contains_key(key) {
                    // Safe read, no double free possible
                    format!("Access granted for key: {}", key)
                } else {
                    (axum::http::StatusCode::UNAUTHORIZED, "Invalid key")
                }
            } else {
                (axum::http::StatusCode::BAD_REQUEST, "Missing key")
            }
        }));

    axum::Server::bind(&"0.0.0.0:3000".parse().unwrap())
        .serve(app.into_make_service())
        .await
        .unwrap();
}

Avoid patterns that might lead to double frees:

• Do not call Box::into_raw and later unsafe { Box::from_raw(ptr) } on the same allocation in multiple places.
• Ensure that any caching or pooling of key data uses reference-counted handles (Arc) rather than raw pointers.
• When integrating with external libraries that manage key material, verify that they do not free memory passed to Axum handlers after use.

Leverage middleBrick’s CLI tool with the command middlebrick scan <url> to validate that your endpoints enforce proper authentication and input validation around API keys. For automated checks in development, use the GitHub Action to fail builds if risky key-handling patterns are detected, and consider the Pro plan for continuous monitoring of key-related endpoints.