Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

MEDIO 6.1CVE-2024-11023 · GHSA-3wf4-68gx-mph8 · Published 18/11/2024 · updated 17/06/2026

En resumen

CVE-2024-11023 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a firebase javascript sdk (google), firebase.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.13%, mayor que el 3.0% de las vulnerabilidades.
Solución: actualizar a 10.9.0 o posterior.

Package	Affected versions	Patched versions
firebase javascript sdk google	`< 10.9.0`	`10.9.0`
firebase npm	`< 10.9.0`	`10.9.0`

Description

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow am actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

NVD description

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

References

nvd.nist.gov/vuln/detail/CVE-2024-11023 · ADVISORY
firebase/firebase-js-sdk#8056 · WEB
firebase/firebase-js-sdk commit 245dd26 · WEB
firebase.google.com/support/release-notes/js · WEB
firebase/firebase-js-sdk · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

firebase javascript sdk

google

< 10.9.0

10.9.0

firebase

npm

< 10.9.0

10.9.0

Description

NVD description

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.