The Apigee Facebook API suffers from a cross site scripting vulnerability.
a7a94d21b2aed2b2fee9db930789367ad50e64c9fc09291d03193c6d8d06ba9a
Title:
-------
Apigee Facebook API - Cross site scripting
Vendor status:
---------------
[18.12.2011] Vulnerability discovered.
[19.12.2011] Contact with the vendor.
[26.12.2011] Vulnerability patched by vendor.
Introduction
----------------
Apigee is for a new internet of APIs - where billions of mobile, tablets,
and set-top apps connect in a web that has moved beyond the browser. Over
200 enterprises and thousands of developers use Apigee technology to make
their APIs better.
Apigee also provide API to Connect facebook with the Graph API.
web page: http://apigee.com/
Facebook API console : https://apigee.com/console/facebook#
Abstract
-----------
Apigee facebook api do not validate or encode the facebook response.
Details:
--------
If attacker post any malicious script in victim wall/send message/write a
comment and victim visit that page through Apigee Api that malicious script
get executed. It not only affects the victim user but also affect all the
users who will visit that page using Apigee API.
Using this vulnerability attacker can steal user cookie and can preformed
all the action that user can