CVE-2024-35232: 
vulnerability analysis and mitigation

CVE-2024-35232 affects github.com/huandu/facebook, a Go package that supports the Facebook Graph API. The vulnerability was discovered on May 24, 2024, and involves the exposure of access tokens in error messages when HTTP requests fail. This security issue affects versions up to 2.7.1 and has been patched in version 2.7.2 (GitHub Advisory).

The vulnerability occurs when the module sends HTTP requests with query parameters containing access_token and the request fails. The error message construction in the session.go file includes the original error message from the net/http module, which can contain the full URL including the access_token query parameter. The issue has been assigned a CVSS v3.1 score of 3.7 (Low) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector with high complexity, no privileges required, and low confidentiality impact (GitHub Advisory).

The vulnerability can lead to the exposure of access tokens when applications log error messages or return them in HTTP responses. This exposure could occur in log servers and other infrastructure components, potentially compromising the confidentiality of access tokens. The impact is particularly relevant for client applications that log error messages from this module or return error messages to clients (GitHub Advisory).

The vulnerability requires no privileges or user interaction to exploit, though it has high attack complexity. The exploit occurs when HTTP requests fail and error messages are logged or exposed, potentially revealing access tokens to unauthorized parties (GitHub Advisory).

The vulnerability has been patched in version 2.7.2 of the github.com/huandu/facebook package. Users should upgrade to this version or later to address the security issue (GitHub Advisory).