Integer Overflow in Feathersjs with Api Keys

An integer overflow in a FeathersJS service that uses API keys can occur when a numeric value derived from or influenced by an API key exceeds the safe integer range during computation or storage. JavaScript uses IEEE-754 double-precision floating-point numbers, so integers are safe only up to Number.MAX_SAFE_INTEGER (2^53 - 1). If an API key or a value derived from it (e.g., a numeric segment, a hash converted to an integer, or a tenant ID) is used in arithmetic that can grow unbounded — such as counters, offsets, or calculated indices — an attacker supplying a crafted key can trigger overflow, leading to incorrect values, negative indices, or type coercion that bypasses authorization checks.

Consider a FeathersJS service that derives a numeric shard ID from an API key prefix and uses it in a database query without validation:

app.use('/tickets', {
  async find(params) {
    const { apikey } = params.query;
    // Dangerous: extracting a numeric suffix from the API key
    const suffix = parseInt(apikey.split('-').pop() || '0', 10);
    const shardId = suffix * 1000000; // Potential overflow if suffix is large
    return db.query('SELECT * FROM tickets WHERE shard = $1', [shardId]);
  }
});

If an API key like key-9007199254740993 is provided, suffix is beyond Number.MAX_SAFE_INTEGER, and the multiplication can produce an incorrect shardId. This can cause cross-shard data access, privilege escalation via IDOR, or application crashes. Because API keys often control access routing, an overflow may unintentionally expose data belonging to other tenants or skip intended rate limits.

In the context of the 12 parallel security checks run by middleBrick, integer overflow maps to Input Validation and Property Authorization. An unauthenticated scan can detect unsafe numeric handling by analyzing service code patterns and runtime behavior when large numeric-like API keys are supplied. Since API keys are often treated as opaque strings, developers may overlook their numeric interpretation, creating a subtle authorization bypass or data exposure path that aligns with OWASP API Top 10:2023 Broken Object Level Authorization (BOLA) and Excessive Data Exposure.

Real-world analogies include CVE-2021-23368 (Prototype Pollution in Lodash) where unexpected input shapes led to privilege escalation; similarly, integer overflow in key-derived values can corrupt access control decisions. MiddleBrick’s OpenAPI/Swagger analysis resolves $ref definitions and cross-references spec structures with runtime findings to highlight mismatches in expected numeric constraints for API-key-gated endpoints.

Remediation focuses on avoiding numeric interpretation of API keys, validating bounds, and isolating key-based routing logic. Do not derive arithmetic values directly from API key segments. Instead, treat API keys as opaque identifiers and use a trusted mapping to safe numeric identifiers.

Secure approach: use a pre-validated mapping from API key to a bounded integer (e.g., tenant ID) with strict range checks:

const MAX_SHARD_ID = 10000; // Bounded, safe value

app.use('/tickets', {
  async find(params) {
    const { apikey } = params.query;
    if (!apikey || typeof apikey !== 'string') {
      throw new Error('Invalid API key');
    }
    // Trusted mapping lookup (e.g., from a configuration or database)
    const tenantId = getTenantIdFromKey(apikey);
    if (tenantId == null || tenantId < 0 || tenantId > MAX_SHARD_ID) {
      throw new Error('Unauthorized or invalid tenant');
    }
    const shardId = tenantId; // Use bounded tenant ID directly
    return db.query('SELECT * FROM tickets WHERE shard = $1', [shardId]);
  }
});

function getTenantIdFromKey(apikey) {
  // Example: constant-time hash to a bounded integer, or lookup from a map
  const knownKeys = {
    'abc123': 1001,
    'def456': 1002,
  };
  return knownKeys[apikey] ?? null;
}

If you must parse numbers from keys, use arbitrary-precision libraries (e.g., big-integer) and enforce strict regex patterns to reject malformed keys early:

const bigInt = require('big-integer');

app.use('/reports', {
  async create(data, params) {
    const { apikey } = params.query;
    const pattern = /^key-[(\d+)]$/;
    const match = apikey && apikey.match(pattern);
    if (!match) {
      throw new Error('Malformed API key');
    }
    const suffix = bigInt(match[1]);
    if (suffix.greater(Number.MAX_SAFE_INTEGER)) {
      throw new Error('Numeric suffix out of safe range');
    }
    const offset = suffix.multiply(1000000);
    // Safe to use offset within application bounds
    return generateReport(offset.toJSNumber());
  }
});

Additionally, enforce rate limiting and monitoring on a per-API-key basis to detect anomalous numeric inputs. With middleBrick’s Pro plan, you can enable continuous monitoring and CI/CD integration (GitHub Action) to fail builds if new endpoints lack proper numeric validation. The MCP Server allows you to scan APIs directly from your IDE, catching risky patterns as you code.