Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0zd2Y0LTY4Z3gtbXBoOM4ABBdB
Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server
Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow am actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.
Permalink: https://github.com/advisories/GHSA-3wf4-68gx-mph8JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zd2Y0LTY4Z3gtbXBoOM4ABBdB
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 23 days ago
Updated: 22 days ago
CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Percentage: 0.00043
EPSS Percentile: 0.10511
Identifiers: GHSA-3wf4-68gx-mph8, CVE-2024-11023
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-11023
- https://github.com/firebase/firebase-js-sdk/pull/8056
- https://firebase.google.com/support/release-notes/js#version_1090_-_march_14_2024
- https://github.com/firebase/firebase-js-sdk/commit/245dd26e19b6c16aca7e1b7e597ed5784c2984ba
- https://github.com/advisories/GHSA-3wf4-68gx-mph8
Blast Radius: 29.0
Affected Packages
npm:firebase
Dependent packages: 4,800Dependent repositories: 296,309
Downloads: 9,036,897 last month
Affected Version Ranges: < 10.9.0
Fixed in: 10.9.0
All affected versions: 0.0.0, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6, 0.6.7, 0.6.8, 0.6.9, 0.6.10, 0.6.11, 0.6.14, 0.6.15, 0.6.16, 0.6.17, 0.6.19, 0.6.21, 0.6.22, 0.800.1, 0.800.2, 0.800.3, 0.800.4, 0.800.5, 0.800.6, 0.800.7, 0.800.8, 0.800.9, 0.800.10, 0.800.11, 0.900.1, 0.900.2, 0.900.3, 0.900.4, 0.900.5, 0.900.6, 0.900.7, 0.900.8, 0.900.9, 0.900.10, 0.900.11, 0.900.12, 0.900.13, 0.900.14, 0.900.15, 0.900.16, 0.900.17, 0.900.18, 0.900.19, 0.900.20, 0.900.21, 0.900.22, 0.900.23, 0.900.24, 0.900.25, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21, 1.0.23, 1.0.24, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.2.0, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.4.2, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.1.0, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.3.2, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 3.6.9, 3.6.10, 3.7.0, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 3.8.0, 3.9.0, 4.0.0, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.2.0, 4.3.0, 4.3.1, 4.4.0, 4.5.0, 4.5.1, 4.5.2, 4.6.0, 4.6.1, 4.6.2, 4.7.0, 4.8.0, 4.8.1, 4.8.2, 4.9.0, 4.9.1, 4.10.0, 4.10.1, 4.11.0, 4.12.0, 4.12.1, 4.13.0, 4.13.1, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.1.0, 5.2.0, 5.3.0, 5.3.1, 5.4.0, 5.4.1, 5.4.2, 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.6.0, 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.8.0, 5.8.1, 5.8.2, 5.8.3, 5.8.4, 5.8.5, 5.8.6, 5.9.0, 5.9.1, 5.9.2, 5.9.3, 5.9.4, 5.10.0, 5.10.1, 5.11.0, 5.11.1, 6.0.0, 6.0.1, 6.0.2, 6.0.4, 6.1.0, 6.1.1, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.4.0, 6.4.1, 6.4.2, 6.5.0, 6.6.0, 6.6.1, 6.6.2, 7.0.0, 7.1.0, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.3.0, 7.4.0, 7.5.0, 7.5.1, 7.5.2, 7.6.0, 7.6.1, 7.6.2, 7.7.0, 7.8.0, 7.8.1, 7.8.2, 7.9.0, 7.9.1, 7.9.2, 7.9.3, 7.10.0, 7.11.0, 7.12.0, 7.13.0, 7.13.1, 7.13.2, 7.14.0, 7.14.1, 7.14.2, 7.14.3, 7.14.4, 7.14.5, 7.14.6, 7.15.0, 7.15.1, 7.15.2, 7.15.3, 7.15.4, 7.15.5, 7.16.0, 7.16.1, 7.17.0, 7.17.1, 7.17.2, 7.18.0, 7.19.0, 7.19.1, 7.20.0, 7.21.0, 7.21.1, 7.22.0, 7.22.1, 7.23.0, 7.24.0, 8.0.0, 8.0.1, 8.0.2, 8.1.0, 8.1.1, 8.1.2, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.4.0, 8.4.1, 8.4.2, 8.4.3, 8.5.0, 8.6.0, 8.6.1, 8.6.2, 8.6.3, 8.6.4, 8.6.5, 8.6.6, 8.6.7, 8.6.8, 8.7.0, 8.7.1, 8.8.0, 8.8.1, 8.9.0, 8.9.1, 8.10.0, 8.10.1, 9.0.0, 9.0.1, 9.0.2, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.2.0, 9.3.0, 9.4.0, 9.4.1, 9.5.0, 9.6.0, 9.6.1, 9.6.2, 9.6.3, 9.6.4, 9.6.5, 9.6.6, 9.6.7, 9.6.8, 9.6.9, 9.6.10, 9.6.11, 9.7.0, 9.8.0, 9.8.1, 9.8.2, 9.8.3, 9.8.4, 9.9.0, 9.9.1, 9.9.2, 9.9.3, 9.9.4, 9.10.0, 9.11.0, 9.12.0, 9.12.1, 9.13.0, 9.14.0, 9.15.0, 9.16.0, 9.17.0, 9.17.1, 9.17.2, 9.18.0, 9.19.0, 9.19.1, 9.20.0, 9.21.0, 9.22.0, 9.22.1, 9.22.2, 9.23.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.4.0, 10.5.0, 10.5.1, 10.5.2, 10.6.0, 10.7.0, 10.7.1, 10.7.2, 10.8.0, 10.8.1
All unaffected versions: 10.9.0, 10.10.0, 10.11.0, 10.11.1, 10.12.0, 10.12.1, 10.12.2, 10.12.3, 10.12.4, 10.12.5, 10.13.0, 10.13.1, 10.13.2, 10.14.0, 10.14.1, 11.0.0, 11.0.1, 11.0.2