CVE-2024-22199
📋 TL;DR
CVE-2024-22199 is a cross-site scripting (XSS) vulnerability in the gofiber/template package that allows attackers to execute malicious scripts in users' browsers when applications render user-supplied data through the template engine. This affects web applications built with the Fiber framework using the Views interface. The vulnerability has been addressed by enabling autoescape by default in the template engine.
💻 Affected Systems
- gofiber/template package
📦 What is this software?
Django by Gofiber
⚠️ Risk & Real-World Impact
Worst Case
Attackers can steal user session cookies, credentials, or sensitive data, perform actions on behalf of authenticated users, and potentially compromise entire user accounts.
Likely Case
Attackers inject malicious JavaScript that runs in victims' browsers, leading to session hijacking, credential theft, or defacement of web pages.
If Mitigated
With proper input validation and output encoding, the risk is minimal as user-supplied data is properly sanitized before rendering.
🎯 Exploit Status
XSS vulnerabilities are commonly exploited and weaponized quickly. The advisory suggests active exploitation is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 28cff3ac4d4c117ab25b5396954676d624b6cb46 or later
Vendor Advisory: https://github.com/gofiber/template/security/advisories/GHSA-4mq2-gc4j-cmw6
Restart Required: Yes
Instructions:
1. Update gofiber/template to latest version. 2. Ensure autoescape is enabled (now default). 3. Restart the application.
🔧 Temporary Workarounds
Enable Autoescape Manually
allManually set autoescape to true in template configuration if unable to update immediately.
engine := html.New("./views", ".html")
engine.Reload(true)
engine.Debug(true)
engine.Autoescape(true)
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user-supplied data before template rendering.
- Use Content Security Policy (CSP) headers to restrict script execution and mitigate XSS impact.
🔍 How to Verify
Check if Vulnerable:
Check if using gofiber/template before commit 28cff3ac4d4c117ab25b5396954676d624b6cb46 and if autoescape is disabled in configuration.Check Version:
go list -m github.com/gofiber/templateVerify Fix Applied:
Verify the package version is updated and autoescape is set to true in the template engine configuration.📡 Detection & Monitoring
Log Indicators:
- Unusual template rendering errors
- Suspicious user input patterns in logs
- Unexpected JavaScript execution in browser logs
Network Indicators:
- Malicious script payloads in HTTP requests
- Unexpected outbound connections from user browsers to attacker-controlled domains
SIEM Query:
source="web_logs" AND (message="*<script>*" OR message="*javascript:*") AND status=200🔗 References
- https://github.com/gofiber/template/commit/28cff3ac4d4c117ab25b5396954676d624b6cb46
- https://github.com/gofiber/template/security/advisories/GHSA-4mq2-gc4j-cmw6
- https://github.com/gofiber/template/commit/28cff3ac4d4c117ab25b5396954676d624b6cb46
- https://github.com/gofiber/template/security/advisories/GHSA-4mq2-gc4j-cmw6
