Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

MITTEL 6.1CVE-2024-11023 · GHSA-3wf4-68gx-mph8 · Published 18/11/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-11023 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in firebase javascript sdk (google), firebase.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.13%, höher als bei 3.0% aller Schwachstellen.
Abhilfe: auf 10.9.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
firebase javascript sdk google	`< 10.9.0`	`10.9.0`
firebase npm	`< 10.9.0`	`10.9.0`

Description

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow am actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

NVD description

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

References

nvd.nist.gov/vuln/detail/CVE-2024-11023 · ADVISORY
firebase/firebase-js-sdk#8056 · WEB
firebase/firebase-js-sdk commit 245dd26 · WEB
firebase.google.com/support/release-notes/js · WEB
firebase/firebase-js-sdk · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

firebase javascript sdk

google

< 10.9.0

10.9.0

firebase

npm

< 10.9.0

10.9.0

Description

NVD description

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.