TI-2024-03844 Aliases CVE-2024-4128 GHSA-rcm2-22f3-pqv3

CSRF in firebase-tools emulator suite

LOW 19CWE-352Published 2024-05-02 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit 068a2b08dc308c7ab4b569617f5fc8821237e3a0 https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0013 2nd percentileScored 2026-11-07

Fix Fixed firebase-tools (npm): 13.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Firebase	firebase-tools	up to 13.6.0	—	No fix listed	CNA
—	firebase-tools (npm)	before 13.6.0	13.6.0	Patch available	GHSA-rcm2-22f3-pqv3

firebase-tools VendorFirebase Affected up to 13.6.0 Fixed in — No fix listed CNA
firebase-tools (npm) Vendor— Affected before 13.6.0 Fixed in 13.6.0 Patch available GHSA-rcm2-22f3-pqv3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:google:firebase_command_line_interface::::::::	before 13.6.0	Vulnerable	Google

cpe:2.3:a:google:firebase_command_line_interface:*:*:*:*:*:*:*:* Versions before 13.6.0 Vulnerable ·Google

Remediation

Fix · GHSA-rcm2-22f3-pqv3 firebase-tools (npm) Fixed in 13.6.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-4128
2026-10-03 Alias added: GHSA-rcm2-22f3-pqv3

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-4128

Other 1

https://github.com/firebase/firebase-tools

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences