PT-2024-16712 · Google · Firebase Javascript Sdk

Camsjams · Published 2024-11-18 · Updated 2025-07-23 · CVE-2024-11023

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firebase JavaScript SDK versions prior to 10.9.0

Description The Firebase JavaScript SDK utilizes a "FIREBASE DEFAULTS" cookie to store configuration data, including an " authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the " authTokenSyncURL" to point to their own server, allowing them to capture user session data transmitted by the SDK.

Recommendations Upgrade Firebase JS SDK to at least version 10.9.0 to resolve the issue. As a temporary workaround, consider restricting access to the " authTokenSyncURL" field to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-11023

GHSA-3WF4-68GX-MPH8

Affected Products

Firebase Javascript Sdk

References · 17

• https://github.com/firebase/firebase-js-sdk/pull/8056 · Patch
• https://osv.dev/vulnerability/CVE-2024-11023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11023 · Security Note
• https://osv.dev/vulnerability/GHSA-3wf4-68gx-mph8 · Vendor Advisory
• https://github.com/firebase/firebase-js-sdk · Note
• https://github.com/firebase/firebase-js-sdk/commit/245dd26e19b6c16aca7e1b7e597ed5784c2984ba · Note
• https://firebase.google.com/support/release-notes/js#version_1090_-_march_14_2024 · Note
• https://twitter.com/transilienceai/status/1859824283649823080 · Twitter Post
• https://twitter.com/CVEnew/status/1858461597330448498 · Twitter Post
• https://twitter.com/transilienceai/status/1859824306865217938 · Twitter Post
• https://twitter.com/transilienceai/status/1859824300594798885 · Twitter Post
• https://twitter.com/transilienceai/status/1859824276347473927 · Twitter Post
• https://twitter.com/transilienceai/status/1859824290159382786 · Twitter Post
• https://t.me/cveNotify/130041 · Telegram Post
• https://twitter.com/transilienceai/status/1859824313609703852 · Twitter Post