PT-2024-26397 · Facebook · Facebook
Seiyab
·
Published
2024-05-24
·
Updated
2024-06-05
·
CVE-2024-35232
CVSS v3.1
3.7
Low
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
github.com/huandu/facebook versions prior to 2.7.2
Description
The issue concerns the exposure of
access token in error messages when HTTP requests fail. This can occur when the module sends HTTP requests with a query parameter ?access token=... and the request fails, resulting in an error message that may contain the full URL, including the access token. This could lead to the access token being stored in log servers or other infrastructures if applications log error messages. The issue can affect client applications that log error messages from the module, return error messages to clients, or use error messages elsewhere.Recommendations
For github.com/huandu/facebook versions prior to 2.7.2, update to version 2.7.2 to resolve the issue. As a temporary workaround, consider modifying error handling to exclude sensitive information like
access token from error messages. Restrict access to error logs and ensure that error messages are not returned to clients or used in a way that could expose sensitive information.Exploit
Fix
Generation of Error Message Containing Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Facebook