Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zZjY1LW0yMzQtOW14cs4AA8iZ

github.com/huandu/facebook may expose access_token in error message.

Summary

access_token can be exposed in error message on fail in HTTP request.

Details

Using this module, when HTTP request fails, error message can contain access_token. This can be happen when:

• module is sending HTTP request with query parameter ?access_token=....
• and HTTP request fails (errors like facebook: cannot reach facebook server).

In such situation, error message is constucted like following.
https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567
Original error message contained in it comes from net/http module. And it can contain full URL, that can contain query parameter access_token:
https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633
https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30

It should be very common that applications log error message when they encounter errors. As a result, access_token can be stored into log server and some other infrastructures. Of course other careless error handling in client code that causing other security problems can exist.

I'm not very sure that whether we can consider that github.com/huandu/facebook is vulnerable. Anyway, I think current error message, that can expose access_token, is not desirble.

PoC

Request me this section if you need complete instruction.

Impact

Client applications with following conditions can be affected.

• logs error message from this module
• or returns error message to client as something like HTTP response.
• or uses error messages somewhere

Permalink: https://github.com/advisories/GHSA-3f65-m234-9mxr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zZjY1LW0yMzQtOW14cs4AA8iZ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: 4 months ago
Updated: 4 months ago

CVSS Score: 3.7
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-3f65-m234-9mxr, CVE-2024-35232
References:

• https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr
• https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4
• https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633
• https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30
• https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567
• https://nvd.nist.gov/vuln/detail/CVE-2024-35232
• https://github.com/advisories/GHSA-3f65-m234-9mxr

Repository: https://github.com/huandu/facebook
Blast Radius: 3.9

Affected Packages