Double Free in Feathersjs with Hmac Signatures

In FeathersJS, authentication plugins that rely on HMAC signatures can encounter a double-free pattern when the framework or an application layer attempts to free or clear sensitive data more than once during request lifecycle events. A double-free here is not a memory management issue in the C sense, but a logic flaw where the same mutable context (e.g., the authentication payload or signature metadata) is processed, invalidated, and then processed again, leading to inconsistent state or exposure of intermediate values.

Consider a FeathersJS service that uses HMAC signatures to verify the integrity of incoming requests. The typical flow involves extracting a signature from headers, recomputing the signature from the request body and secret, and comparing them. If the application hooks mutate the same object used to hold the signature or the payload across multiple before hooks (e.g., one hook strips a field, another attempts to re-derive the signature), the shared reference can lead to a double-free-like condition where the signature verification context is corrupted. This can expose the original signature or intermediate data if one of the hooks logs or returns the mutated object inadvertently.

For example, if a before hook calls hook.data.body to compute an HMAC and then another hook later reassigns or mutates hook.data.body without preserving the original state, the comparison between the extracted and recomputed signatures may become unreliable. In some configurations, this can lead to authentication bypass if the signature validation logic incorrectly treats a cleared or overwritten value as valid. The vulnerability is amplified when the HMAC verification is performed in a plugin that does not isolate each verification step, allowing an attacker to manipulate headers or body in a way that triggers the double-free pattern and leaks information through error messages or inconsistent responses.

Real-world parallels include issues described in CVE-2020-15168, where improper handling of signature verification contexts led to information exposure. In FeathersJS, the risk is not a remote code execution but an authentication integrity flaw where an attacker might force the application into a state where the HMAC validation logic is bypassed or its intermediate values are exposed through crafted requests that exploit the double-free pattern in hook execution order.

To detect this using middleBrick, which scans the unauthenticated attack surface and runs 12 security checks including Input Validation and Authentication, you would submit your FeathersJS endpoint. The scan evaluates how the API handles HMAC-based authentication and flags inconsistencies in signature processing, providing findings with severity and remediation guidance mapped to frameworks like OWASP API Top 10.

Remediation focuses on ensuring that the HMAC verification context is immutable during the request lifecycle and that hooks do not mutate shared objects used for signature validation. Below are concrete code examples for secure HMAC signature handling in FeathersJS.

Secure HMAC Signature Verification Example

Use a dedicated authentication hook that extracts and verifies the HMAC without mutating the request body. This example uses Node.js built-in crypto module and FeathersJS hooks.

const crypto = require('crypto');

function verifyHmac(secret) {
  return (hook) => {
    const { headers, body } = hook;
    const receivedSignature = headers['x-hmac-signature'];
    if (!receivedSignature) {
      throw new Error('Missing HMAC signature');
    }

    // Create a stable string to sign: method + path + sorted query + body
    const payload = [
      hook.method.toLowerCase(),
      hook.url,
      Object.keys(hook.query || {}).sort().map(k => `${k}=${hook.query[k]}`).join('&'),
      typeof body === 'string' ? body : JSON.stringify(body || {})
    ].join('\n');

    const computedSignature = crypto
      .createHmac('sha256', secret)
      .update(payload)
      .digest('hex');

    // Use timing-safe comparison to prevent timing attacks
    if (!crypto.timingSafeEqual(Buffer.from(receivedSignature), Buffer.from(computedSignature))) {
      throw new Error('Invalid HMAC signature');
    }

    // Do not mutate hook.data.body or any shared object used for verification
    return hook;
  };
}

// In your FeathersJS service configuration
const app = require('feathers')();
app.configure(authentication({
  entity: 'user',
  service: 'users',
  authStrategies: ['hmac']
}));

app.use('/api/secure', createService({
  // service options
}));

app.service('/api/secure').hooks({
  before: {
    all: [verifyHmac('your-256-bit-secret')],
    find: [],
    get: [],
    create: [],
    update: [],
    patch: [],
    remove: []
  }
});

Avoiding Shared Object Mutation Across Hooks

Ensure that any hook that processes the request does not reuse the same object reference for signature verification and later modifications. Instead, create copies or use immutable patterns.

// Bad: mutating the same hook.data object across hooks
app.service('items').hooks({
  before: {
    create: [
      (hook) => {
        // This mutation can interfere with HMAC verification if run in wrong order
        hook.data.body.processed = true;
        return hook;
      },
      verifyHmac('secret') // This may see mutated body
    ]
  }
});

// Good: isolate verification from mutation
app.service('items').hooks({
  before: {
    create: [
      verifyHmac('secret'), // Runs first with original body
      (hook) => {
        // Work with a copy if needed
        const safeBody = { ...hook.data.body, processed: true };
        // Proceed with safeBody, but do not alter hook.data.body until after verification
        hook.data.body = safeBody;
        return hook;
      }
    ]
  }
});

Additional Hardening

• Always use crypto.timingSafeEqual for signature comparison to prevent timing attacks.
• Include all relevant parts of the request (HTTP method, URL, sorted query parameters, and the request body) in the payload that is signed to prevent parameter substitution attacks.
• Validate and normalize inputs before signing to avoid issues with encoding or whitespace.
• In the middleBrick ecosystem, use the CLI (middlebrick scan <url>) to verify that your endpoints do not expose signature validation flaws, and consider the Pro plan for continuous monitoring of HMAC-based endpoints in CI/CD pipelines via the GitHub Action.

These practices mitigate the double-free pattern by ensuring that the HMAC verification context remains consistent and isolated from mutation, reducing the risk of authentication bypass or information exposure.