GHSA-3wf4-68gx-mph8

Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-11023

Packages

Ecosystem	Package	Affected	Fixed in
npm	firebase	< 10.9.0	10.9.0

Details

As written in the advisory (Markdown source, shown as plain text).

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow am actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

References

External links from the advisory. They lead to third-party sites.

Dates

Published: 2024-11-18
Modified: 2025-07-23
Reviewed: 2024-11-18

Severity

5.3 CVSS 3 base score, computed from the vector

GitHub rating: Moderate
CVSS 3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 4.0: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness

CWE-79

Source

From the GitHub Advisory Database, licensed CC-BY 4.0; reformatted here (ranges summarised, score computed).