Out Of Bounds Read in Actix with Jwt Tokens

An Out Of Bounds Read occurs when a program reads memory beyond the allocated buffer. In Actix web applications that handle JWT tokens, this can arise when parsing or validating tokens using byte-level operations that do not properly enforce length constraints. If a developer manually slices a byte slice (&[u8]) representing a JWT header or payload using an offset and length derived from attacker-controlled data, the read may cross the underlying buffer boundary. For example, extracting the header segment by computing a position based on header length fields without verifying bounds can expose sensitive stack memory or cause undefined behavior.

Consider a scenario where a JWT token is processed by splitting the compact representation into parts using dot separators. If the code uses string indexing or byte offsets derived from token metadata without validating against the actual token length, an Out Of Bounds Read can occur. A token crafted with an unusually short payload section may lead the parser to read past the end of the buffer when attempting to decode base64url-encoded segments. This can expose uninitialized memory or parts of the process memory that are not intended to be read, potentially leaking information used in further attacks.

Because Actix often deserializes JWT claims into strongly typed structures, an Out Of Bounds Read may be triggered during the binding phase if the deserializer trusts token length fields implicitly. For instance, if a Claims structure expects a fixed-size field and the token provides a shorter encoded value, a manual copy into a fixed-size array may read beyond the provided bytes. This is especially relevant when using low-level byte manipulation to optimize performance, as bounds checks may be inadvertently omitted.

An attacker can exploit this by sending a malformed JWT with crafted header or payload lengths that cause the server to read memory outside the token buffer. While the primary goal is typically information disclosure, such reads can sometimes lead to more severe vulnerabilities when combined with other weaknesses. Using middleBrick, such misconfigurations can be detected through its 12 security checks, including Input Validation and Unsafe Consumption, which analyze how JWT tokens are parsed and handled in Actix endpoints.

To detect this risk during scanning, middleBrick evaluates whether JWT handling code properly validates token structure before performing byte-level operations. The scanner examines patterns such as direct indexing into token segments and the use of unchecked slice operations. Because middleBrick performs black-box testing against the unauthenticated attack surface, it can identify endpoints where JWT tokens may trigger boundary violations without requiring authentication or source code access.

Remediation focuses on ensuring all operations on JWT tokens respect buffer boundaries and use safe parsing methods. Avoid manual byte slicing based on unvalidated lengths; instead, use established libraries that handle token parsing with built-in bounds checking. When working with JWTs in Actix, prefer high-level deserializers that validate token structure before mapping claims.

Below are concrete code examples demonstrating secure handling of JWT tokens in Actix. The first example uses the jsonwebtoken crate to decode and validate a token safely, ensuring that all field lengths are verified during deserialization.

use actix_web::{web, HttpResponse, Result};
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};
use serde::{Deserialize, Serialize};

#[derive(Debug, Serialize, Deserialize)]
struct Claims {
    sub: String,
    exp: usize,
}

async fn validate_token(token: web::Json<String>) -> Result<HttpResponse> {
    let token_str = token.into_inner();
    let decoding_key = DecodingKey::from_secret("secret".as_ref());
    let validation = Validation::new(Algorithm::HS256);

    match decode::(&token_str, &decoding_key, &validation) {
        Ok(token_data) => Ok(HttpResponse::Ok().json(token_data.claims)),
        Err(_) => Ok(HttpResponse::Unauthorized().finish()),
    }
}

This approach relies on the library to manage buffer boundaries and avoid unsafe slicing. The token string is passed as a whole to the decoder, which handles base64url decoding and length checks internally.

A second example demonstrates validating token structure before processing individual segments, ensuring that dot separators are present and that each part has a minimum length. This prevents the parser from attempting to read beyond the token boundaries when splitting.

fn safe_split_token(token: &str) -> Option<(&str, &str, &str)> {
    let parts: Vec<&str> = token.split('.').collect();
    if parts.len() != 3 {
        return None;
    }
    // Ensure each part is non-empty and within reasonable length
    if parts[0].len() <= 100 && parts[1].len() <= 200 && parts[2].len() <= 300 {
        Some((parts[0], parts[1], parts[2]))
    } else {
        None
    }
}

By enforcing length constraints on each segment, this function avoids creating slices that could exceed the token buffer. MiddleBrick scans can verify that such checks are present and that JWT parsing logic does not rely on unchecked offsets.

Using middleBrick’s CLI, you can validate these patterns by running middlebrick scan <url> against endpoints that accept JWT tokens. The tool’s Input Validation and Unsafe Consumption checks will highlight endpoints where token handling may be vulnerable. For continuous protection, the Pro plan enables scheduled scans and GitHub Action integration to catch regressions before deployment.