GitHub Advisoryadvisory · npm

GHSA-3wf4-68gx-mph8 Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

MEDIUM Published 2024-11-18 Modified 2025-07-23 Official page ↗
Aliases
CVE-2024-11023
Ecosystem
npm
Packages
firebase
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-79
Reviewed
2024-11-18

Affected packages

• npm firebase: < 10.9.0 → fixed in 10.9.0

Description

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow am actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

Related

Alias · CVE (1)

  • CVE-2024-11023 Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References