Executive brief
The Node.js client library for Google Cloud Firestore (a managed NoSQL database service) inadvertently exposed authentication credentials when developers logged Firestore objects for debugging purposes. An attacker with access to application logs could extract the exposed API key and use it to gain unauthorized access to the Firestore database, compromising customer data and application availability.
Technical details
The vulnerability exists in the nodejs-firestore library where Firestore object properties (WriteBatch, Transaction, DocumentReference, etc.) were enumerable, allowing developers who logged these objects via JSON.stringify() or similar serialization methods to inadvertently expose the firestore API key stored in the this._settings property. The root cause is insufficient encapsulation of sensitive configuration data. Attack preconditions include a developer logging Firestore objects during debugging or error handling, and an attacker with read access to application logs. An attacker can extract the exposed credentials to authenticate API calls to the victim's Firestore database. The vulnerability was fixed in version 6.1.0 (released September 7, 2022) by preventing serialization of firestore settings, likely through the use of Object.defineProperty to make sensitive properties non-enumerable.
Affected products
- Google @google-cloud/firestore all versions before 6.1.0
Timeline
- 2023-12-04: disclosed
- 2022-09-07: patched: Fixed in version 6.1.0