Vulnerability · Published Nov 18, 2024 · Assigned by Google
CVE-2024-11023Session Hijacking in Firebase JavaScript SDK
Medium 5.3
In plain English
A medium-severity cross-site scripting in JavaScript SDK from Firebase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | firebase | 10.9.0 | GHSA-3wf4-68gx-mph8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Firebase | JavaScript SDK | 0 – before 10.9.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N