[Full-disclosure] Apigee Facebook API - Cross site scripting

[asish agarwalla <asishagarwalla@xxxxxxxxx>]

Title:
-------
Apigee Facebook API - Cross site scripting


Vendor status:
---------------
[18.12.2011] Vulnerability discovered.
[19.12.2011] Contact with the vendor.
[26.12.2011] Vulnerability patched by vendor.


Introduction
----------------
Apigee is for a new internet of APIs - where billions of mobile, tablets,
and set-top apps connect in a web that has moved beyond the browser. Over
200 enterprises and thousands of developers use Apigee technology to make
their APIs better.

Apigee also provide  API to Connect facebook with the Graph API.

web page: http://apigee.com/
Facebook API console : https://apigee.com/console/facebook#


Abstract
-----------
Apigee facebook api do not validate or encode the facebook response.


Details:
--------
If attacker post any malicious script in victim wall/send message/write a
comment and victim visit that page through Apigee Api that malicious script
get executed. It not only affects the victim user but also affect all the
users who will visit that page using Apigee API.

Using this vulnerability attacker can steal user cookie and can preformed
all the action that user can performed using the Apigee API.

@Asish

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/