CVE-2024-11023 Session Hijacking in Firebase JavaScript SDK
Attackers can hijack user sessions by manipulating the Firebase defaults cookie to redirect authentication tokens to a malicious server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-11023?
CVE-2024-11023 is a medium-severity authentication bypass vulnerability in Firebase JavaScript SDK, published on 18 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.
Weakness: CWE-79
Which versions are affected by CVE-2024-11023?
2 open source packages ship an affected version, including firebase. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
firebase npm | All versions | 10.9.0 |
firebase npm | All versions | 10.9.0 |
Products include Google Firebase Javascript Sdk.
How do I fix CVE-2024-11023?
Upgrade firebase to 10.9.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-11023 being exploited?
There is no known exploitation of CVE-2024-11023 in the wild and no public exploit code.
Sources
Also known as GHSA-3wf4-68gx-mph8.