Use After Free in Fiber

Use After Free (UAF) vulnerabilities occur when a program continues to use a pointer after the memory it references has been freed. In Fiber applications, this manifests through several specific patterns that are particularly dangerous given Go's memory management model.

The most common UAF pattern in Fiber involves middleware lifecycle management. Consider a middleware that allocates resources during initialization but doesn't properly handle cleanup:

func vulnerableMiddleware() fiber.Handler {
    data := make([]byte, 1024)
    
    return func(c *fiber.Ctx) error {
        // Using 'data' after it's been potentially cleared
        c.Locals("buffer", data)
        return c.Next()
    }
}

app.Use(vulnerableMiddleware())
app.Use(func(c *fiber.Ctx) error {
    buffer := c.Locals("buffer").([]byte)
    // 'buffer' may reference freed memory if middleware was reinitialized
    return c.Next()
})

Another Fiber-specific UAF scenario occurs with context cancellation and goroutine cleanup. When a request is cancelled, Fiber triggers context cancellation, but if goroutines aren't properly cancelled, they may continue accessing freed resources:

app.Use(func(c *fiber.Ctx) error {
    ctx := c.Context()
    
    // Start a goroutine that might outlive the request
    go func() {
        // This goroutine may access 'ctx' after cancellation
        <-ctx.Done()
        // Accessing freed context data here is UAF
    }()
    
    return c.Next()
})

WebSocket handlers in Fiber present another UAF vector. When a WebSocket connection is closed, the underlying connection is freed, but if message handlers aren't properly synchronized, they may continue reading from freed memory:

ws, err := app.WebSocket("/ws")
if err != nil {
    return err
}

ws.OnConnect(func(c *fiber.Connection) {
    // Connection is allocated here
})

ws.OnMessage(func(c *fiber.Connection, msg []byte) {
    // This may fire after connection is closed/freed
    c.Context().Response().Write(msg)
})

ws.OnDisconnect(func(c *fiber.Connection) {
    // Connection is freed here
})

Detecting Use After Free in Fiber applications requires both static analysis and runtime monitoring. The most effective approach combines automated scanning with manual code review.

middleBrick's API security scanner includes specific checks for UAF patterns in Go/Fiber applications. When you scan a Fiber API endpoint, middleBrick analyzes the runtime behavior and identifies potential UAF vulnerabilities through several mechanisms:

Memory Lifecycle Analysis: middleBrick tracks how memory is allocated and freed across middleware chains. It identifies patterns where pointers are stored in context locals, session data, or global variables without proper lifecycle management.

# Scan your Fiber API with middleBrick
middlebrick scan https://your-fiber-app.com/api

The scanner specifically looks for Fiber patterns like context cancellation races, goroutine leaks, and WebSocket handler synchronization issues. It generates a security score with detailed findings:

{
  "use_after_free": {
    "severity": "high",
    "category": "Memory Management",
    "description": "Potential UAF in WebSocket message handler",
    "remediation": "Implement proper synchronization with sync.WaitGroup",
    "confidence": "medium"
  }
}

For manual detection, use Go's race detector during testing:

go test -race ./...
go run -race main.go

Additionally, implement runtime monitoring in your Fiber application:

import (
    "runtime/debug"
    "github.com/gofiber/fiber/v2"
)

func uafProtectionMiddleware() fiber.Handler {
    return func(c *fiber.Ctx) error {
        defer func() {
            if r := recover(); r != nil {
                // Log potential UAF or use-after-free
                debug.PrintStack()
            }
        }()
        return c.Next()
    }
}

app.Use(uafProtectionMiddleware())

Remediating Use After Free vulnerabilities in Fiber requires a combination of proper memory management patterns and Fiber-specific best practices. Here are the most effective remediation strategies:

1. Proper Context Lifecycle Management:

func safeMiddleware() fiber.Handler {
    return func(c *fiber.Ctx) error {
        // Use context cancellation properly
        ctx, cancel := context.WithCancel(c.Context())
        defer cancel()
        
        // Store cancellable context in locals
        c.Locals("ctx", ctx)
        
        // Ensure all goroutines respect cancellation
        err := c.Next()
        cancel() // Cancel when done
        return err
    }
}

app.Use(safeMiddleware())

2. Goroutine Synchronization:

func safeGoroutine(c *fiber.Ctx) {
    ctx := c.Context()
    
    // Use a wait group to track goroutine lifecycle
    var wg sync.WaitGroup
    wg.Add(1)
    
    go func() {
        defer wg.Done()
        
        select {
        case <-ctx.Done():
            // Context cancelled, exit safely
            return
        case <-time.After(5 * time.Second):
            // Normal operation
        }
    }()
    
    // Wait for goroutine to complete or timeout
    done := make(chan struct{})
    go func() {
        wg.Wait()
        close(done)
    }()
    
    select {
    case <-done:
        return
    case <-time.After(10 * time.Second):
        // Timeout handling
    }
}

3. WebSocket Handler Safety:

ws, err := app.WebSocket("/ws")
if err != nil {
    return err
}

var mu sync.RWMutex
var connections = make(map[*fiber.Connection]struct{})

ws.OnConnect(func(c *fiber.Connection) {
    mu.Lock()
    connections[c] = struct{}{}
    mu.Unlock()
})

ws.OnMessage(func(c *fiber.Connection, msg []byte) {
    mu.RLock()
    defer mu.RUnlock()
    
    // Check if connection is still valid
    if _, exists := connections[c]; !exists {
        return
    }
    
    // Process message safely
    c.Context().Response().Write(msg)
})

ws.OnDisconnect(func(c *fiber.Connection) {
    mu.Lock()
    delete(connections, c)
    mu.Unlock()
})

4. Memory Pool Management:

var bufferPool = sync.Pool{
    New: func() interface{} {
        return make([]byte, 1024)
    },
}

func bufferMiddleware() fiber.Handler {
    return func(c *fiber.Ctx) error {
        // Get buffer from pool
        buffer := bufferPool.Get().([]byte)
        defer func() {
            // Return buffer to pool safely
            bufferPool.Put(buffer)
        }()
        
        c.Locals("buffer", buffer)
        return c.Next()
    }
}

5. Request Scoping:

type requestScope struct {
    data []byte
    mu   sync.Mutex
}

func scopedMiddleware() fiber.Handler {
    return func(c *fiber.Ctx) error {
        scope := &requestScope{
            data: make([]byte, 1024),
        }
        
        c.Locals("scope", scope)
        defer func() {
            // Clean up scope when request ends
            scope.mu.Lock()
            scope.data = nil
            scope.mu.Unlock()
        }()
        
        return c.Next()
    }
}