Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS0zd2Y0LTY4Z3gtbXBoOM4ABBdB

Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow am actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

Permalink: https://github.com/advisories/GHSA-3wf4-68gx-mph8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zd2Y0LTY4Z3gtbXBoOM4ABBdB
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 23 days ago
Updated: 22 days ago


CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Percentage: 0.00043
EPSS Percentile: 0.10511

Identifiers: GHSA-3wf4-68gx-mph8, CVE-2024-11023
References: Repository: https://github.com/firebase/firebase-js-sdk
Blast Radius: 29.0

Affected Packages

npm:firebase
Dependent packages: 4,800
Dependent repositories: 296,309
Downloads: 9,036,897 last month
Affected Version Ranges: < 10.9.0
Fixed in: 10.9.0
All affected versions: 0.0.0, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6, 0.6.7, 0.6.8, 0.6.9, 0.6.10, 0.6.11, 0.6.14, 0.6.15, 0.6.16, 0.6.17, 0.6.19, 0.6.21, 0.6.22, 0.800.1, 0.800.2, 0.800.3, 0.800.4, 0.800.5, 0.800.6, 0.800.7, 0.800.8, 0.800.9, 0.800.10, 0.800.11, 0.900.1, 0.900.2, 0.900.3, 0.900.4, 0.900.5, 0.900.6, 0.900.7, 0.900.8, 0.900.9, 0.900.10, 0.900.11, 0.900.12, 0.900.13, 0.900.14, 0.900.15, 0.900.16, 0.900.17, 0.900.18, 0.900.19, 0.900.20, 0.900.21, 0.900.22, 0.900.23, 0.900.24, 0.900.25, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21, 1.0.23, 1.0.24, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.2.0, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.4.2, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.1.0, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.3.2, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 3.6.9, 3.6.10, 3.7.0, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 3.8.0, 3.9.0, 4.0.0, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.2.0, 4.3.0, 4.3.1, 4.4.0, 4.5.0, 4.5.1, 4.5.2, 4.6.0, 4.6.1, 4.6.2, 4.7.0, 4.8.0, 4.8.1, 4.8.2, 4.9.0, 4.9.1, 4.10.0, 4.10.1, 4.11.0, 4.12.0, 4.12.1, 4.13.0, 4.13.1, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.1.0, 5.2.0, 5.3.0, 5.3.1, 5.4.0, 5.4.1, 5.4.2, 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.6.0, 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.8.0, 5.8.1, 5.8.2, 5.8.3, 5.8.4, 5.8.5, 5.8.6, 5.9.0, 5.9.1, 5.9.2, 5.9.3, 5.9.4, 5.10.0, 5.10.1, 5.11.0, 5.11.1, 6.0.0, 6.0.1, 6.0.2, 6.0.4, 6.1.0, 6.1.1, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.4.0, 6.4.1, 6.4.2, 6.5.0, 6.6.0, 6.6.1, 6.6.2, 7.0.0, 7.1.0, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.3.0, 7.4.0, 7.5.0, 7.5.1, 7.5.2, 7.6.0, 7.6.1, 7.6.2, 7.7.0, 7.8.0, 7.8.1, 7.8.2, 7.9.0, 7.9.1, 7.9.2, 7.9.3, 7.10.0, 7.11.0, 7.12.0, 7.13.0, 7.13.1, 7.13.2, 7.14.0, 7.14.1, 7.14.2, 7.14.3, 7.14.4, 7.14.5, 7.14.6, 7.15.0, 7.15.1, 7.15.2, 7.15.3, 7.15.4, 7.15.5, 7.16.0, 7.16.1, 7.17.0, 7.17.1, 7.17.2, 7.18.0, 7.19.0, 7.19.1, 7.20.0, 7.21.0, 7.21.1, 7.22.0, 7.22.1, 7.23.0, 7.24.0, 8.0.0, 8.0.1, 8.0.2, 8.1.0, 8.1.1, 8.1.2, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.4.0, 8.4.1, 8.4.2, 8.4.3, 8.5.0, 8.6.0, 8.6.1, 8.6.2, 8.6.3, 8.6.4, 8.6.5, 8.6.6, 8.6.7, 8.6.8, 8.7.0, 8.7.1, 8.8.0, 8.8.1, 8.9.0, 8.9.1, 8.10.0, 8.10.1, 9.0.0, 9.0.1, 9.0.2, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.2.0, 9.3.0, 9.4.0, 9.4.1, 9.5.0, 9.6.0, 9.6.1, 9.6.2, 9.6.3, 9.6.4, 9.6.5, 9.6.6, 9.6.7, 9.6.8, 9.6.9, 9.6.10, 9.6.11, 9.7.0, 9.8.0, 9.8.1, 9.8.2, 9.8.3, 9.8.4, 9.9.0, 9.9.1, 9.9.2, 9.9.3, 9.9.4, 9.10.0, 9.11.0, 9.12.0, 9.12.1, 9.13.0, 9.14.0, 9.15.0, 9.16.0, 9.17.0, 9.17.1, 9.17.2, 9.18.0, 9.19.0, 9.19.1, 9.20.0, 9.21.0, 9.22.0, 9.22.1, 9.22.2, 9.23.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.4.0, 10.5.0, 10.5.1, 10.5.2, 10.6.0, 10.7.0, 10.7.1, 10.7.2, 10.8.0, 10.8.1
All unaffected versions: 10.9.0, 10.10.0, 10.11.0, 10.11.1, 10.12.0, 10.12.1, 10.12.2, 10.12.3, 10.12.4, 10.12.5, 10.13.0, 10.13.1, 10.13.2, 10.14.0, 10.14.1, 11.0.0, 11.0.1, 11.0.2