CVE-2024-4128 CSRF in firebase-tools emulator suite
A CSRF vulnerability in the Firebase emulator suite allows malicious websites to exfiltrate local emulator data from developers running the tool.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-4128?
CVE-2024-4128 is a low-severity vulnerability in firebase-tools, published on 2 May 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit 068a2b08dc308c7ab4b569617f5fc8821237e3a0 https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0
Weakness: CWE-352
Which versions are affected by CVE-2024-4128?
3 open source packages ship an affected version, including firebase-tools and github.com/firebase/firebase-tools. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
firebase-tools npm | All versions | 13.6.0 |
firebase-tools npm | All versions | 13.6.0 |
github.com/firebase/firebase-tools Go | All versions | None |
Products include Google Firebase Command Line Interface.
How do I fix CVE-2024-4128?
Upgrade firebase-tools to 13.6.0 or later.
Is CVE-2024-4128 being exploited?
There is no known exploitation of CVE-2024-4128 in the wild and no public exploit code.
Sources
Also known as GHSA-rcm2-22f3-pqv3, GO-2024-2808.