Out Of Bounds Write in Fiber with Hmac Signatures

An Out Of Bounds Write occurs when a program writes data past the allocated boundaries of a buffer, which can corrupt memory, crash processes, or lead to arbitrary code execution. In the Fiber HTTP framework for Go, this risk can emerge when request handling logic relies on unchecked or loosely bounded buffers while also using Hmac Signatures for request authentication. The combination becomes dangerous when signature verification is performed on user-supplied inputs that later control memory-like structures such as slices, byte arrays, or custom buffers, and those inputs are not strictly validated for length or range.

Consider a scenario where an API endpoint accepts a payload that includes a data field and an Hmac signature. If the server uses the signature to authenticate the payload but then copies the data field into a fixed-size buffer using an unchecked length parameter derived from the payload, an attacker can supply a length that exceeds the buffer size. Even though the Hmac Signature confirms data integrity and origin, the unchecked length enables an out of bounds write when copying into the buffer. This shows that Hmac Signature verification does not inherently prevent memory corruption; it only authenticates that the data has not been tampered with.

Another vector involves path-based routing where route parameters are used to index into internal structures or buffers. If route parameters are not validated for size and an Hmac Signature is used to authenticate the request, the server may still perform unsafe operations such as slicing or copying based on those parameters. For example, an attacker could send a long identifier in the path that causes the application to compute an incorrect slice end, leading to a write outside intended memory bounds. The presence of Hmac Signatures might make developers assume stronger integrity guarantees than actually exist, increasing the likelihood that such unchecked memory operations are introduced.

In the context of the 12 security checks run by middleBrick, this vulnerability would surface under the BFLA/Privilege Escalation and Input Validation categories. The scanner tests whether length-derived operations respect boundaries even when a valid Hmac Signature is present, and whether framework-specific patterns in Fiber inadvertently allow user-controlled size fields to dictate memory operations. Since middleBrick examines unauthenticated attack surfaces, it can detect endpoints where crafted payloads or paths trigger boundary violations despite signature checks, providing prioritized findings with severity and remediation guidance.

To remediate Out Of Bounds Write risks when using Hmac Signatures in Fiber, enforce strict bounds checking on all length or size values derived from request data, even after signature verification. Use fixed-size buffers with explicit copy limits, and prefer higher-level abstractions such as slices with length validation or helper libraries that prevent overflow. Below are concrete, working examples for Fiber that demonstrate secure handling of Hmac Signatures alongside safe memory operations.

Example 1: Validated payload handling with Hmac Signature in Fiber

//go
package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "net/http"

    "github.com/gofiber/fiber/v2"
)

const secret = "my_secure_secret_key"

func verifySignature(payload, receivedSig string) bool {
    key := []byte(secret)
    mac := hmac.New(sha256.New, key)
    mac.Write([]byte(payload))
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(expected), []byte(receivedSig))
}

func safeHandler(c *fiber.Ctx) error {
    payload := c.FormValue("data")
    sig := c.FormValue("signature")

    if !verifySignature(payload, sig) {
        return c.Status(http.StatusUnauthorized).SendString("invalid signature")
    }

    // Enforce strict length bounds before using payload
    maxLen := 256
    if len(payload) > maxLen {
        return c.Status(http.StatusBadRequest).SendString("payload too large")
    }

    // Use a fixed-size buffer with explicit copy limits
    var buf [512]byte
    n := copy(buf[:], payload)
    _ = n // use buf[:n] for further processing safely

    return c.SendString("ok")
}

func main() {
    app := fiber.New()
    app.Post("/submit", safeHandler)
    app.Listen(":3000")
}

Example 2: Route parameter validation with Hmac Signature in Fiber

//go
package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "net/http"
    "strconv"

    "github.com/gofiber/fiber/v2"
)

const secret = "my_secure_secret_key"

func verifyRouteSig(id int, receivedSig string) bool {
    key := []byte(secret)
    mac := hmac.New(sha256.New, key)
    mac.Write([]byte(strconv.Itoa(id)))
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(expected), []byte(receivedSig))
}

func itemHandler(c *fiber.Ctx) error {
    param := c.Params("id")
    sig := c.Query("sig")

    id, err := strconv.Atoi(param)
    if err != nil || id < 0 || id > 10000 {
        return c.Status(http.StatusBadRequest).SendString("invalid id")
    }

    if !verifyRouteSig(id, sig) {
        return c.Status(http.StatusUnauthorized).SendString("invalid route signature")
    }

    // Use id safely within bounded operations
    const maxItems = 100
    if id >= maxItems {
        return c.Status(http.StatusBadRequest).SendString("id out of range")
    }

    // Example of safe indexing into a fixed-size collection
    items := [maxItems]string{"..."}
    _ = items[id] // safe access

    return c.SendString("ok")
}

func main() {
    app := fiber.New()
    app.Get("/item/:id", itemHandler)
    app.Listen(":3000")
}

These examples illustrate that Hmac Signatures should be part of a broader defense-in-depth strategy. Always validate and sanitize input lengths, enforce maximum bounds for buffers and collections, and avoid allowing user-controlled values to dictate memory operations directly. Tools like middleBrick can help identify endpoints where such controls may be insufficient, even when Hmac Signatures are in use.