Use After Free in Axum with Mutual Tls

A Use After Free (UAF) occurs when memory is deallocated but references to it remain in use, leading to unpredictable behavior or potential code execution. In Axum, a Rust web framework, UAF can arise when handlers or extractors hold references to data that has been freed or reused. When Mutual Transport Layer Security (Mutual Tls) is enforced, the server performs client certificate validation before routing requests to application logic. This handshake introduces additional allocations for certificates, identity metadata, and per-connection state. If the application or middleware retains pointers into these transient structures beyond their lifetime—such as storing raw references in async blocks, thread-local caches, or request extensions—the underlying memory can be freed after the TLS session ends but before the references are cleared. The combination of Mutual Tls and Axum’s async runtime amplifies the risk: certificate material may be moved or dropped across await points, and handlers that capture references to request extensions or TLS-derived data can inadvertently access freed memory when requests overlap or are retried.

Consider a scenario where a custom Axum extractor parses a client certificate and stores a slice pointing to its raw bytes in an extension. If the TLS layer reuses or deallocates that certificate buffer after the extractor runs—common in high-concurrency environments with Mutual Tls—subsequent handler execution may read or write to invalid memory. This can manifest as crashes, information disclosure, or, in rare cases, controlled code execution depending on what data occupies the freed space. Real-world attack patterns such as those cataloged in the OWASP API Top 10 (e.g., Excessive Data Exposure and Improper Resource Management) align with these failure modes. Because Axum relies on Rust’s ownership model, the compiler often prevents obvious UAF, but subtle cases involving lifetimes, Arc clones, or unsafe blocks interacting with TLS context objects can evade detection. Runtime findings from security scans—such as those provided by middleBrick—can highlight missing synchronization or unsafe retention of TLS-derived data, which otherwise might remain latent until triggered by specific concurrency conditions.

To mitigate UAF in Axum with Mutual Tls, ensure that any data derived from TLS handshakes is owned and explicitly scoped to the request lifecycle. Avoid storing raw references into certificate buffers; instead, clone or serialize the necessary fields into owned types before inserting them into request extensions or async closures. Below are concrete code examples demonstrating safe patterns.

Example 1: Safe extraction with owned data

use axum::{routing::get, Router, Extension};
use std::sync::Arc;

// Owned wrapper for certificate metadata
#[derive(Clone)]
struct ClientCertInfo {
    subject: String,
    fingerprint: String,
}

async fn handler(Extension(info): Extension>) -> String {
    format!("Subject: {}, Fingerprint: {}", info.subject, info.fingerprint)
}

fn build_app() -> Router {
    // Simulate extracting and cloning certificate data during TLS validation
    let cert_info = Arc::new(ClientCertInfo {
        subject: "CN=example.com".to_string(),
        fingerprint: "AA:BB:CC".to_string(),
    });
    Router::new()
        .route("/secure", get(handler))
        .layer(Extension(cert_info))
}

Example 2: Middleware that avoids holding TLS references

use axum::{middleware::Next, http::Request, response::Response, extract::RequestExt};
use std::future::ready;
use std::task::{Context, Poll};

// A middleware that reads certificate info without retaining references
async fn cert_middleware(req: Request, next: Next) -> Response {
    // Extract owned data from TLS context (simulated)
    if let Some(cert_data) = req.extensions().get::() {
        // Use owned copy, do not store raw pointers
        let fingerprint = cert_data.clone();
        // Proceed with request, using fingerprint as needed
        println!("Processing request with fingerprint: {}", fingerprint);
    }
    next.run(req).await
}

# .github/workflows/api-security.yml
name: API Security Checks
on: [push]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run middleBrick scan
        uses: middlebjorn/middlebrick-action@v1
        with:
          url: ${{ secrets.TEST_API_URL }}
          threshold: C