CVE-2024-35232 – github.com/huandu/facebook/v2

Package

Manager: go
Name: github.com/huandu/facebook/v2
Vulnerable Version: >=0 <2.7.2

Severity

Level: Low

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00046 pctl0.13482

Details

github.com/huandu/facebook may expose access_token in error message. ### Summary access_token can be exposed in error message on fail in HTTP request. ### Details Using this module, when HTTP request fails, error message can contain access_token. This can be happen when: - module is sending HTTP request with query parameter `?access_token=...`. - and HTTP request fails (errors like `facebook: cannot reach facebook server`). In such situation, error message is constucted like following. https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567 Original error message contained in it comes from `net/http` module. And it can contain full URL, that can contain query parameter `access_token`: https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633 https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30 It should be very common that applications log error message when they encounter errors. As a result, access_token can be stored into log server and some other infrastructures. Of course other careless error handling in client code that causing other security problems can exist. I'm not very sure that whether we can consider that github.com/huandu/facebook is vulnerable. Anyway, I think current error message, that can expose access_token, is not desirble. ### PoC Request me this section if you need complete instruction. ### Impact Client applications with following conditions can be affected. - logs error message from this module - or returns error message to client as something like HTTP response. - or uses error messages somewhere

Metadata

Created: 2024-05-24T20:19:53Z
Modified: 2024-05-29T20:43:59Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-3f65-m234-9mxr/GHSA-3f65-m234-9mxr.json
CWE IDs: ["CWE-209"]
Alternative ID: GHSA-3f65-m234-9mxr
Finding: F037
Auto approve: 1