Information Disclosure in Fiber

Information disclosure vulnerabilities in Fiber applications often arise from misconfigured error handling and improper data exposure in responses. When Fiber applications encounter errors, the default behavior can inadvertently expose sensitive information about the system's internals, including stack traces, database queries, or configuration details.

app := fiber.New()

Without proper configuration, Fiber's default error handling middleware may return detailed error messages to clients. For instance, when a database connection fails or an unexpected panic occurs, the raw error message might include database credentials, file paths, or other sensitive information that attackers can exploit.

app.Get("/sensitive", func(c *fiber.Ctx) error {
    // Database query that might fail
    rows, err := db.Query("SELECT * FROM users WHERE id = ?", c.Params("id"))
    if err != nil {
        return err // This exposes raw database error
    }
    defer rows.Close()
    // ...
    return c.JSON(fiber.Map{"data": data})
})

Another common pattern in Fiber applications involves exposing internal server details through HTTP headers or response bodies. Developers might inadvertently include debug information, server versions, or application state in responses that should remain internal.

app.Get("/debug", func(c *fiber.Ctx) error {
    return c.JSON(fiber.Map{
        "server": "Fiber v2.42.0",
        "debug": true,
        "internal_state": getInternalState(), // Exposes internal data
    })
})

Environment variable exposure represents another critical information disclosure vector in Fiber applications. When configuration data is improperly handled, environment variables containing database URLs, API keys, or other secrets might be exposed through error messages or debug endpoints.

app.Get("/config", func(c *fiber.Ctx) error {
    return c.JSON(fiber.Map{
        "database_url": os.Getenv("DATABASE_URL"), // Exposes sensitive config
        "api_key": os.Getenv("API_KEY"),
    })
})

Detecting information disclosure vulnerabilities in Fiber applications requires both manual code review and automated scanning. The middleBrick scanner provides Fiber-specific detection capabilities that identify common information disclosure patterns without requiring authentication or access to source code.

middleBrick's black-box scanning approach tests the unauthenticated attack surface of your Fiber API endpoints, looking for exposed sensitive data patterns. The scanner examines HTTP responses for indicators of information disclosure, including stack traces, error messages containing system details, and exposed configuration data.

middlebrick scan https://api.example.com

The scanner's 12 parallel security checks include specific tests for data exposure vulnerabilities that commonly affect Fiber applications. These tests examine response bodies, headers, and error messages for patterns that suggest sensitive information leakage.

For Fiber applications using OpenAPI specifications, middleBrick can perform spec analysis alongside runtime scanning. This dual approach helps identify discrepancies between documented API behavior and actual implementation, which often reveals information disclosure issues.

# Example OpenAPI spec that might reveal information disclosure
paths:
  /debug:
    get:
      summary: Debug endpoint
      responses:
        '200':
          description: Debug information
          content:
            application/json:
              schema:
                type: object
                properties:
                  server:
                    type: string
                  debug:
                    type: boolean
                  internal_state:
                    type: object  # Should this be exposed?

middleBrick's LLM/AI security checks also detect information disclosure in AI-powered Fiber endpoints. The scanner tests for system prompt leakage and excessive agency patterns that might expose sensitive training data or proprietary logic.

Remediating information disclosure vulnerabilities in Fiber applications requires implementing proper error handling and response filtering. The first step is configuring Fiber's error handling middleware to prevent detailed error messages from reaching clients.

app := fiber.New(fiber.Config{
    ErrorHandler: func(c *fiber.Ctx, err error) error {
        // Log the detailed error internally
        log.Printf("Error: %v", err)
        
        // Return generic error message to client
        return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
            "error": "An unexpected error occurred",
        })
    },
})

For database operations and other operations that might fail, implement proper error handling that doesn't expose system details. Use custom error types and wrap errors without exposing sensitive information.

type AppError struct {
    Code    int    `json:"code"`
    Message string `json:"message"`
}

func (e *AppError) Error() string {
    return e.Message
}

func sensitiveHandler(c *fiber.Ctx) error {
    // Safe database query with proper error handling
    rows, err := db.Query("SELECT * FROM users WHERE id = ?", c.Params("id"))
    if err != nil {
        log.Printf("Database error: %v", err) // Log internally
        return &AppError{500, "Database operation failed"}
    }
    defer rows.Close()
    
    var data []User
    for rows.Next() {
        var u User
        if err := rows.Scan(&u.ID, &u.Name); err != nil {
            log.Printf("Scan error: %v", err)
            return &AppError{500, "Data processing failed"}
        }
        data = append(data, u)
    }
    
    return c.JSON(fiber.Map{"data": data})
}

Implement response filtering to prevent sensitive data from being included in API responses. Create middleware that sanitizes responses before they're sent to clients.

func sanitizeResponseMiddleware() fiber.Handler {
    return func(c *fiber.Ctx) error {
        // Continue to next handler
        err := c.Next()
        
        // Check if we should sanitize response
        if c.Response().Header.StatusCode() == fiber.StatusOK {
            // Remove sensitive headers
            c.Response().Header.Del("X-Powered-By")
            c.Response().Header.Del("Server")
            
            // Optionally sanitize response body (if JSON)
            if c.Response().Header.Get("Content-Type") == "application/json" {
                body := c.Response().Body()
                // Implement sanitization logic here
            }
        }
        
        return err
    }
}

app.Use(sanitizeResponseMiddleware())

For configuration data, ensure environment variables and sensitive settings are never exposed through API endpoints. Use proper configuration management and validate that debug endpoints are properly secured or removed in production.

// Secure configuration handling
func getConfig(c *fiber.Ctx) error {
    // Never expose raw environment variables
    return c.JSON(fiber.Map{
        "status": "healthy",
    })
}