Summary
access_token can be exposed in error message on fail in HTTP request.
Details
Using this module, when HTTP request fails, error message can contain access_token. This can be happen when:
- module is sending HTTP request with query parameter
?access_token=....
- and HTTP request fails (errors like
facebook: cannot reach facebook server).
In such situation, error message is constucted like following.
|
if session.HttpClient == nil { |
|
response, err = http.DefaultClient.Do(request) |
|
} else { |
|
response, err = session.HttpClient.Do(request) |
|
} |
|
|
|
if err != nil { |
|
err = fmt.Errorf("facebook: cannot reach facebook server; %w", err) |
|
return |
|
} |
Original error message contained in it comes from
net/http module. And it can contain full URL, that can contain query parameter
access_token:
https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633
https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30
It should be very common that applications log error message when they encounter errors. As a result, access_token can be stored into log server and some other infrastructures. Of course other careless error handling in client code that causing other security problems can exist.
I'm not very sure that whether we can consider that github.com/huandu/facebook is vulnerable. Anyway, I think current error message, that can expose access_token, is not desirble.
PoC
Request me this section if you need complete instruction.
Impact
Client applications with following conditions can be affected.
- logs error message from this module
- or returns error message to client as something like HTTP response.
- or uses error messages somewhere
Summary
access_token can be exposed in error message on fail in HTTP request.
Details
Using this module, when HTTP request fails, error message can contain access_token. This can be happen when:
?access_token=....facebook: cannot reach facebook server).In such situation, error message is constucted like following.
facebook/session.go
Lines 558 to 567 in 1591be2
Original error message contained in it comes from
net/httpmodule. And it can contain full URL, that can contain query parameteraccess_token:https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633
https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30
It should be very common that applications log error message when they encounter errors. As a result, access_token can be stored into log server and some other infrastructures. Of course other careless error handling in client code that causing other security problems can exist.
I'm not very sure that whether we can consider that github.com/huandu/facebook is vulnerable. Anyway, I think current error message, that can expose access_token, is not desirble.
PoC
Request me this section if you need complete instruction.
Impact
Client applications with following conditions can be affected.