Side Channel Attack in Axum

Side channel attacks in Axum applications exploit timing differences, memory access patterns, and resource consumption to extract sensitive information. Unlike traditional attacks that target application logic directly, side channel attacks observe indirect effects of operations to infer secrets.

In Axum applications, timing attacks are particularly relevant when handling authentication and authorization. Consider an endpoint that validates user credentials:

async fn authenticate(&self, user: String, pass: String) -> Result<User, Error> {
    let user_record = User::find_by_username(&user).await?;
    if user_record.password_hash != hash_password(pass) {
        return Err(Error::Unauthorized);
    }
    Ok(user_record)
}

This implementation leaks information through timing. A non-existent username returns immediately, while an existing user with a wrong password triggers the hash comparison, taking longer. An attacker can measure response times to enumerate valid usernames.

Memory access patterns create another side channel. When handling different user roles, conditional logic based on user attributes can leak information:

async fn get_user_data(&self, user_id: String, requesting_user: UserId) -> Result<Json<UserData>, Error> {
    let target_user = User::find_by_id(&user_id).await?;
    let requesting_user = User::find_by_id(&requesting_user).await?;
    
    if requesting_user.role == Role::Admin || requesting_user.id == target_user.id {
        // Admin or self can access
        return Ok(Json(target_user.data.clone()));
    } else if requesting_user.role == Role::Premium {
        // Premium users get limited data
        return Ok(Json(target_user.data.clone().limit_to_premium()));
    } else {
        // Free users get minimal data
        return Ok(Json(target_user.data.clone().limit_to_free()));
    }
}

The different code paths execute varying amounts of work, creating timing differences an attacker can measure. Even when the same HTTP status code is returned, the response time reveals whether the user exists and what role the requester has.

Resource exhaustion attacks also create side channels. An endpoint that performs expensive operations based on user input:

async fn process_large_data(&self, data: Vec<u8>) -> Result<Json<ResultData>, Error> {
    let processed = heavy_computation(&data).await?;
    Ok(Json(processed))
}

Without proper limits, an attacker can send varying payload sizes to measure how long processing takes, potentially inferring implementation details or causing denial of service conditions.

Detecting side channel vulnerabilities in Axum requires both manual code review and automated scanning. middleBrick's black-box scanning approach is particularly effective because it measures actual runtime behavior without requiring source code access.

For timing attacks, middleBrick measures response variations across multiple requests. When scanning an authentication endpoint, it submits both valid and invalid credentials while measuring response times:

$ middlebrick scan https://api.example.com/auth/login
Authentication Timing Analysis:
✓ No significant timing variations detected (max diff: 2ms)
✓ Constant-time comparison appears implemented

The scanner uses statistical analysis to determine if timing differences exceed normal network variance. For endpoints with authorization logic, it tests with different user roles and measures response time distributions.

middleBrick's LLM security checks are relevant for Axum applications using AI features. System prompt leakage can occur through timing when different prompts trigger different processing paths:

async fn process_prompt(&self, prompt: String) -> Result<Json<Response>, Error> {
    let response = match classify_prompt(&prompt) {
        PromptType::SimpleQuestion => handle_simple_question(prompt),
        PromptType::CodeGeneration => handle_code_generation(prompt),
        PromptType::ComplexAnalysis => handle_complex_analysis(prompt),
    Ok(Json(response))
}

middleBrick detects if different prompt types create measurable timing variations that could leak information about the classification logic.

For resource-based side channels, middleBrick tests with varying payload sizes and measures CPU utilization patterns. The scanner identifies endpoints where processing time correlates with input characteristics:

$ middlebrick scan https://api.example.com/process
Resource Analysis:
⚠️ Input-dependent processing detected (variance: 450ms)
⚠️ No rate limiting on endpoint
⚠️ Potential for resource exhaustion attacks

The CLI tool provides JSON output for integration with CI/CD pipelines:

$ middlebrick scan --format=json https://api.example.com/auth
{
  "side_channel": {
    "timing_vulnerability": false,
    "resource_exhaustion": true,
    "recommendations": ["Implement constant-time comparisons", "Add rate limiting"]
  }
}