Vulnerability-Lookup

CVE-2024-35232 (GCVE-0-2024-35232)

Vulnerability from cvelistv5 – Published: 2024-05-24 20:44 – Updated: 2024-08-02 03:07

Title

github.com/huandu/facebook may expose access_token in error message

Summary

github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/huandu/facebook/security/advis…	x_refsource_CONFIRM
https://github.com/huandu/facebook/commit/8b34431…	x_refsource_MISC
https://cs.opensource.google/go/go/+/refs/tags/go…	x_refsource_MISC
https://cs.opensource.google/go/go/+/refs/tags/go…	x_refsource_MISC
https://github.com/huandu/facebook/blob/1591be276…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
huandu	facebook	Affected: <= 2.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:facebook:facebook:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "facebook",
            "vendor": "facebook",
            "versions": [
              {
                "lessThanOrEqual": "2.7.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35232",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T15:09:27.854178Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T19:00:46.713Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:07:46.857Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr"
          },
          {
            "name": "https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4"
          },
          {
            "name": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633"
          },
          {
            "name": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30"
          },
          {
            "name": "https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "facebook",
          "vendor": "huandu",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.7.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-24T20:44:09.233Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr"
        },
        {
          "name": "https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4"
        },
        {
          "name": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633"
        },
        {
          "name": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30"
        },
        {
          "name": "https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567"
        }
      ],
      "source": {
        "advisory": "GHSA-3f65-m234-9mxr",
        "discovery": "UNKNOWN"
      },
      "title": "github.com/huandu/facebook may expose access_token in error message"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-35232",
    "datePublished": "2024-05-24T20:44:09.233Z",
    "dateReserved": "2024-05-14T15:39:41.785Z",
    "dateUpdated": "2024-08-02T03:07:46.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35232",
      "date": "2026-05-26",
      "epss": "0.00076",
      "percentile": "0.22677"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35232\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-05-24T21:15:59.450\",\"lastModified\":\"2024-11-21T09:19:59.250\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2.\\n\"},{\"lang\":\"es\",\"value\":\"github.com/huandu/facebook es un paquete Go que es totalmente compatible con la API Graph de Facebook con carga de archivos, solicitud por lotes y API de marketing. access_token puede exponerse en un mensaje de error si falla la solicitud HTTP. Este problema se solucion\u00f3 en la versi\u00f3n 2.7.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"}]}],\"references\":[{\"url\":\"https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"github.com/huandu/facebook may expose access_token in error message\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-209\", \"lang\": \"en\", \"description\": \"CWE-209: Generation of Error Message Containing Sensitive Information\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 3.7, \"baseSeverity\": \"LOW\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr\"}, {\"name\": \"https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4\"}, {\"name\": \"https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633\"}, {\"name\": \"https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30\"}, {\"name\": \"https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567\"}], \"affected\": [{\"vendor\": \"huandu\", \"product\": \"facebook\", \"versions\": [{\"version\": \"\u003c= 2.7.1\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-05-24T20:44:09.233Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2.\\n\"}], \"source\": {\"advisory\": \"GHSA-3f65-m234-9mxr\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35232\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-28T15:09:27.854178Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:facebook:facebook:*:*:*:*:*:*:*:*\"], \"vendor\": \"facebook\", \"product\": \"facebook\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.7.1\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-28T15:10:40.826Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35232\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2024-05-14T15:39:41.785Z\", \"datePublished\": \"2024-05-24T20:44:09.233Z\", \"dateUpdated\": \"2024-06-05T19:00:46.713Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-35232

Vulnerability from fkie_nvd - Published: 2024-05-24 21:15 - Updated: 2026-04-15 00:35

Severity

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633
	security-advisories@github.com	https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30
	security-advisories@github.com	https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567
	security-advisories@github.com	https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4
	security-advisories@github.com	https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr
	af854a3a-2127-422b-91ae-364da2661108	https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633
	af854a3a-2127-422b-91ae-364da2661108	https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2.\n"
    },
    {
      "lang": "es",
      "value": "github.com/huandu/facebook es un paquete Go que es totalmente compatible con la API Graph de Facebook con carga de archivos, solicitud por lotes y API de marketing. access_token puede exponerse en un mensaje de error si falla la solicitud HTTP. Este problema se solucion\u00f3 en la versi\u00f3n 2.7.2."
    }
  ],
  "id": "CVE-2024-35232",
  "lastModified": "2026-04-15T00:35:42.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-05-24T21:15:59.450",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3F65-M234-9MXR

Vulnerability from github – Published: 2024-05-24 20:19 – Updated: 2024-05-29 20:43

Summary

github.com/huandu/facebook may expose access_token in error message.

Details

Summary

access_token can be exposed in error message on fail in HTTP request.

Details

Using this module, when HTTP request fails, error message can contain access_token. This can be happen when: - module is sending HTTP request with query parameter ?access_token=.... - and HTTP request fails (errors like facebook: cannot reach facebook server).

In such situation, error message is constucted like following. https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567 Original error message contained in it comes from net/http module. And it can contain full URL, that can contain query parameter access_token: https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633 https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30

It should be very common that applications log error message when they encounter errors. As a result, access_token can be stored into log server and some other infrastructures. Of course other careless error handling in client code that causing other security problems can exist.

I'm not very sure that whether we can consider that github.com/huandu/facebook is vulnerable. Anyway, I think current error message, that can expose access_token, is not desirble.

PoC

Request me this section if you need complete instruction.

Impact

Client applications with following conditions can be affected. - logs error message from this module - or returns error message to client as something like HTTP response. - or uses error messages somewhere

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.7.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/huandu/facebook/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-35232"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-24T20:19:53Z",
    "nvd_published_at": "2024-05-24T21:15:59Z",
    "severity": "LOW"
  },
  "details": "### Summary\naccess_token can be exposed in error message on fail in HTTP request.\n\n### Details\nUsing this module, when HTTP request fails, error message can contain access_token. This can be happen when:\n- module is sending HTTP request with query parameter `?access_token=...`.\n- and HTTP request fails (errors like `facebook: cannot reach facebook server`).\n\nIn such situation, error message is constucted like following.\nhttps://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567\nOriginal error message contained in it comes from `net/http` module. And it can contain full URL, that can contain query parameter `access_token`:\nhttps://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633\nhttps://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30\n\nIt should be very common that applications log error message when they encounter errors. As a result, access_token can be stored into log server and some other infrastructures. Of course other careless error handling in client code that causing other security problems can exist.\n\nI\u0027m not very sure that whether we can consider that github.com/huandu/facebook is vulnerable. Anyway, I think current error message, that can expose access_token, is not desirble.\n\n### PoC\nRequest me this section if you need complete instruction.\n\n### Impact\nClient applications with following conditions can be affected.\n- logs error message from this module\n- or returns error message to client as something like HTTP response.\n- or uses error messages somewhere\n",
  "id": "GHSA-3f65-m234-9mxr",
  "modified": "2024-05-29T20:43:59Z",
  "published": "2024-05-24T20:19:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35232"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4"
    },
    {
      "type": "WEB",
      "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633"
    },
    {
      "type": "WEB",
      "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/huandu/facebook"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "github.com/huandu/facebook may expose access_token in error message."
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-35232 (GCVE-0-2024-35232)

FKIE_CVE-2024-35232

GHSA-3F65-M234-9MXR

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature