CVE-2024-35232 github.com/huandu/facebook may expose access_token in error message
An attacker can obtain sensitive access tokens from error messages generated during failed HTTP requests in the Facebook Graph API Go library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35232?
CVE-2024-35232 is a low-severity vulnerability in huandu facebook, published on 24 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2.
Weakness: CWE-209
Which versions are affected by CVE-2024-35232?
4 open source packages ship an affected version, including github.com/huandu/facebook/v2 and github.com/huandu/facebook.
| Package | Affected | Fixed in |
|---|---|---|
github.com/huandu/facebook/v2 Go | All versions | 2.7.2 |
github.com/huandu/facebook/v2 Go | All versions | 2.7.2 |
github.com/huandu/facebook/v2 Go | All versions | 2.7.2 |
github.com/huandu/facebook Go | All versions | None |
How do I fix CVE-2024-35232?
Upgrade github.com/huandu/facebook/v2 to 2.7.2 or later.
Is CVE-2024-35232 being exploited?
There is no known exploitation of CVE-2024-35232 in the wild and no public exploit code.
Sources
Also known as GHSA-3f65-m234-9mxr, GO-2024-2882.