GHSA-3f65-m234-9mxr

Source

https://github.com/advisories/GHSA-3f65-m234-9mxr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-3f65-m234-9mxr/GHSA-3f65-m234-9mxr.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-3f65-m234-9mxr

Aliases

Related

CVE-2024-35232

Published

2024-05-24T20:19:53Z

Modified

2024-06-05T16:42:16.362407Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

github.com/huandu/facebook may expose access_token in error message.

Details

Summary

access_token can be exposed in error message on fail in HTTP request.

Details

Using this module, when HTTP request fails, error message can contain access_token. This can be happen when: - module is sending HTTP request with query parameter ?access_token=.... - and HTTP request fails (errors like facebook: cannot reach facebook server).

In such situation, error message is constucted like following. https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567 Original error message contained in it comes from net/http module. And it can contain full URL, that can contain query parameter access_token: https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633 https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30

It should be very common that applications log error message when they encounter errors. As a result, access_token can be stored into log server and some other infrastructures. Of course other careless error handling in client code that causing other security problems can exist.

I'm not very sure that whether we can consider that github.com/huandu/facebook is vulnerable. Anyway, I think current error message, that can expose access_token, is not desirble.

PoC

Request me this section if you need complete instruction.

Impact

Client applications with following conditions can be affected. - logs error message from this module - or returns error message to client as something like HTTP response. - or uses error messages somewhere

Database specific

{
    "nvd_published_at": "2024-05-24T21:15:59Z",
    "cwe_ids": [
        "CWE-209"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-24T20:19:53Z"
}

References

Affected packages

Go / github.com/huandu/facebook/v2

Package

Name: github.com/huandu/facebook/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/huandu/facebook/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.7.2

Database specific

{
    "last_known_affected_version_range": "<= 2.7.1"
}