Poodle Attack in Fiber with Basic Auth

The Poodle attack (CVE-2014-3566) exploits weaknesses in SSL 3.0, particularly its use of predictable initialization vectors in CBC-mode ciphersuites. When an API endpoint served over TLS also supports SSL 3.0, an attacker who can position themselves on the network can perform byte-at-a-time decryption of encrypted data. In a Fiber-based service that uses HTTP Basic Authentication, this becomes especially dangerous because credentials are transmitted in an Authorization header rather than being protected by additional application-layer safeguards.

Consider a Fiber server that accepts cleartext HTTP and upgrades selected routes to TLS, or a server that listens on both ports with TLS enabled for some endpoints. If the TLS configuration includes any SSL 3.0 ciphersuites (even as a fallback), a Poodle attack becomes feasible. An attacker can intercept and downgrade sessions to SSL 3.0, then repeatedly modify requests—such as altering the path or query parameters—and observe differences in error timing or response bodies to gradually recover the encrypted Authorization header value. In this scenario, Basic Auth credentials are not inherently confidential because SSL 3.0 CBC does not provide strong integrity protection against this padding oracle.

middleBrick detects this risk by checking whether the endpoint supports SSL 3.0 during the unauthenticated scan. When scanning a Fiber endpoint that offers Basic Auth over a TLS-enabled route, the scanner flags the presence of SSL 3.0 as a high-severity finding tied to Poodle (CVE-2014-3566). This is categorized under Encryption and Data Exposure checks, and it appears alongside configuration-level findings such as weak ciphers and missing HTTP security headers. The scanner does not attempt to exploit the vulnerability but highlights the combination of Basic Auth and SSL 3.0 as a high-risk pattern that can lead to credential recovery via padding oracle techniques.

Because the scanner reviews OpenAPI/Swagger specifications and runtime behavior, it can correlate the use of security schemes defined as basic auth with the negotiated TLS protocols reported by the endpoint. If the TLS negotiation includes SSL 3.0, the scan output includes a prioritized finding with remediation guidance: remove SSL 3.0 support entirely and enforce TLS 1.2 or higher. This ensures that even if Basic Auth is used, credentials are transmitted only over connections that provide strong confidentiality and integrity guarantees, reducing the feasibility of decryption attacks like Poodle.

To mitigate Poodle-related risks when using HTTP Basic Authentication in Fiber, you should disable SSL 3.0, prefer strong ciphers, and avoid sending credentials over unencrypted channels. Below are concrete, working examples that demonstrate secure Fiber configurations.

1. Secure TLS configuration with Basic Auth in Fiber

Ensure your TLS configuration explicitly disables SSL 3.0 and uses strong ciphers. In Go’s crypto/tls, you achieve this by setting MinVersion to tls.VersionTLS12 and specifying a curated list of ciphersuites.

package main

import (
	"crypto/tls"
	"log"

	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/basicauth"
)

func main() {
	// Configure TLS to disable SSL 3.0 and weak ciphers
	tlsConfig := &tls.Config{
		MinVersion: tls.VersionTLS12,
		CipherSuites: []uint16{
			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
		},
	}

	// Create a Fiber app with TLS
	app := fiber.New(fiber.Config{
		TLSConfig: tlsConfig,
	})

	// Protect a route with Basic Auth
	app.Get("/secure", basicauth.New(basicauth.Config{
		Users: map[string]string{"admin": "SuperSecret123"},
	}), func(c *fiber.Ctx) error {
		return c.SendString("Authenticated access granted")
	})

	log.Println("Server running on https://localhost:8443")
	log.Fatal(app.Listen(":8443"))
}

2. Redirect HTTP to HTTPS and avoid cleartext Basic Auth

Do not serve Basic Auth over plain HTTP. Use middleware to redirect all HTTP traffic to HTTPS and apply Basic Auth only over TLS.

package main

import (
	"log"

	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/redirect"
	"github.com/gofiber/fiber/v2/middleware/basicauth"
)

func main() {
	// HTTP server that redirects to HTTPS
	appHTTP := fiber.New()
	appHTTP.Use(redirect.New(redirect.Config{
		SSL: true,
	}))
	go func() {
		log.Println("HTTP redirect server on :80")
		log.Fatal(appHTTP.Listen(":80"))
	}()

	// HTTPS server with secure TLS and Basic Auth
	appHTTPS := fiber.New(fiber.Config{
		// Use a strong TLS config as shown earlier
	})
	appHTTPS.Use(basicauth.New(basicauth.Config{
		Users: map[string]string{"operator": "CorrectHorseBatteryStaple"},
	}))
	appHTTPS.Get("/data", func(c *fiber.Ctx) error {
		return c.JSON(fiber.Map{"status": "ok"})
	})

	log.Println("HTTPS server running on :8443")
	log.Fatal(appHTTPS.Listen(":8443"))
}

These examples ensure that credentials are only transmitted over connections that disable SSL 3.0 and enforce modern ciphers. For ongoing protection, use middleBrick’s CLI to scan your endpoints regularly with the command middlebrick scan <url>, or integrate the GitHub Action to fail builds if a scan detects SSL 3.0 or missing security headers. The MCP Server can also be used to scan APIs directly from your IDE, providing early feedback during development.