Server Side Template Injection in Fiber with Basic Auth

Server Side Template Injection (SSTI) in Fiber with Basic Auth can occur when user-controlled input is passed into a server-side template function without proper validation or escaping. In Go, this commonly involves the html/template or text/template packages. Basic Auth in Fiber typically parses credentials from the Authorization header and may use them in template rendering, for example to personalize UI elements or error messages. If a handler directly injects the username or password (or a derived value) into a template, and the template executes functions like .Execute or evaluates dynamic keys, an attacker may supply template syntax such as {{.Username}} or more dangerous constructs like {{define "new"}}...{{end}} depending on the template engine behavior, leading to unintended code execution or data exfiltration.

Consider a scenario where Basic Auth credentials are stored in context and later used in a template map. A vulnerable handler might look like this:

username := basicUserFromContext(c) // extracted from Authorization header
c.Render(http.StatusOK, template.H{"user": username})

If the template associated with the render call includes dynamic interpolation of the user value without proper escaping, and the template engine permits function calls or field access, an attacker who knows the Basic Auth credentials could inject payloads that alter control flow or read files. While html/template has some built-in escaping, it is not foolproof when used with custom delimiters or when the template calls functions like safeHTML. The risk is elevated when developers mistakenly trust the Basic Auth header as a safe source, leading to SSTI via crafted usernames or passwords that contain template expressions. This combination exposes an unauthenticated or low-privilege attack surface because Basic Auth credentials are often static or weakly managed, making them predictable inputs for probing template behavior.

In the context of middleBrick’s security checks, this scenario maps to the Authentication and Input Validation categories, where scanners verify whether user-supplied data (including credentials used in templates) is properly sanitized and whether template functions are restricted. Findings may highlight unsafe rendering patterns that could enable SSTI, alongside missing output encoding, aligning with OWASP API Top 10 and other compliance frameworks.

To mitigate SSTI in Fiber when using Basic Auth, ensure that any data derived from credentials is treated as plain text and never directly interpolated into executable template constructs. Use strict escaping and avoid passing raw credential values into template functions. Below are concrete remediation examples.

1) Safe rendering with escaping: Use template.HTMLEscapeString or rely on html/template’s automatic escaping when rendering user-controlled strings.

import (
    "net/http"
    "html/template"
    "github.com/gofiber/fiber/v2"
)

func handler(c *fiber.Ctx) error {
    username := basicUserFromContext(c)
    // Escape user-controlled data before passing to template
    safeUser := template.HTMLEscapeString(username)
    return c.Render(http.StatusOK, fiber.Map{
        "user": safeUser,
    }, "template-name")
}

2) Avoid dynamic template execution based on credentials: Instead of injecting credentials into template logic, keep templates static and pass only non-sensitive, sanitized metadata.

func handler(c *fiber.Ctx) error {
    // Do not pass raw Basic Auth fields into template definitions
    _ = basicUserFromContext(c)
    // Use predefined template without user-controlled logic
    return c.Render(http.StatusOK, fiber.Map{
        "status": "authenticated",
    }, "static-template")
}

3) Validate and constrain credentials early: Reject usernames or passwords that contain template-like patterns if they are ever used in rendering contexts.

import "regexp"

func isValidInput(value string) bool {
    // Reject common template delimiters in credential fields used for UI
    pattern := regexp.MustCompile(`[{}%$#]+`)
    return !pattern.MatchString(value)
}

func handler(c *fiber.Ctx) error {
    username := basicUserFromContext(c)
    if !isValidInput(username) {
        return c.Status(fiber.StatusBadRequest).SendString("invalid characters")
    }
    return c.Render(http.StatusOK, fiber.Map{"user": username}, "profile")
}

These steps align with the scanner’s checks for Input Validation and Authentication, and they help ensure that Basic Auth credentials do not become an attack vector for SSTI. The middleBrick CLI can be used to verify remediation by scanning endpoints after changes, and the GitHub Action can enforce that no risky patterns reach production.