CVE-2018-1000025 Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability
Attackers can forge JWTs to impersonate users and gain unauthorized access due to missing signature verification in the Firebase Admin SDK for PHP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000025?
CVE-2018-1000025 is a high-severity authentication bypass vulnerability in n/a, published on 9 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or from thin air. This attack appear to be exploitable via Attacker would only need to know email address of the victim on most cases.. This vulnerability appears to have been fixed in 3.8.1.
Weakness: CWE-732
Which versions are affected by CVE-2018-1000025?
2 open source packages ship an affected version, including kreait/firebase-php. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kreait/firebase-php Packagist | From 3.2.0 | 3.8.1 |
kreait/firebase-php Packagist | From 3.2.0 | 3.8.1 |
Products include Firebase Admin Sdk for Php Project Firebase Admin Sdk for Php.
How do I fix CVE-2018-1000025?
Upgrade kreait/firebase-php to 3.8.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-1000025 being exploited?
There is no known exploitation of CVE-2018-1000025 in the wild and no public exploit code.
Sources
Also known as GHSA-4gjj-r7w8-42cq.