Executive brief
The Firebase JavaScript SDK, a tool used by developers to integrate Google Firebase services into web applications, contains a vulnerability that could allow an attacker to hijack user sessions. By manipulating a specific configuration cookie, an attacker can redirect session synchronization data to a server they control. This could lead to the theft of sensitive authentication tokens and unauthorized access to user accounts.
Technical details
The Firebase JavaScript SDK utilizes a 'FIREBASE_DEFAULTS' cookie to store configuration data, including an '_authTokenSyncURL' field used for session synchronization. A vulnerability exists where the SDK fails to validate that this URL is a relative path on the same domain. If an attacker can preset this cookie (for example, via a separate XSS vulnerability or cookie injection), they can point the synchronization URL to a malicious external domain. This allows the attacker to capture user session data transmitted by the SDK. The fix, introduced in version 10.9.0, enforces that the synchronization URL must be a relative path.
Affected products
- Google firebase < 10.9.0
Timeline
- 2024-03-06: patched: Fix merged into master branch
- 2024-03-14: advisory: Release notes for version 10.9.0 published
- 2024-11-18: disclosed: Public security advisory and CVE assignment