TI-2024-10213 Aliases CVE-2024-11023 GHSA-3wf4-68gx-mph8

Session Hijacking in Firebase JavaScript SDK

LOW 23CWE-79Published 2024-11-18 · Updated 2024-11-18

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Active
Attack complexity: High
Attack requirements: Present
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00134 2nd percentileScored 2026-11-07

Fix Fixed JavaScript SDK (Firebase): 10.9.0firebase (npm): 10.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Firebase	JavaScript SDK	before 10.9.0	10.9.0	Patch available	CNA
—	firebase (npm)	before 10.9.0	10.9.0	Patch available	GHSA-3wf4-68gx-mph8

JavaScript SDK VendorFirebase Affected before 10.9.0 Fixed in 10.9.0 Patch available CNA
firebase (npm) Vendor— Affected before 10.9.0 Fixed in 10.9.0 Patch available GHSA-3wf4-68gx-mph8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:google:firebase_javascript_sdk::::::::	before 10.9.0	Vulnerable	Google

cpe:2.3:a:google:firebase_javascript_sdk:*:*:*:*:*:*:*:* Versions before 10.9.0 Vulnerable ·Google

Remediation

Fix · CNA JavaScript SDK (Firebase) Fixed in 10.9.0
Fix · GHSA-3wf4-68gx-mph8 firebase (npm) Fixed in 10.9.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-11023
2026-10-03 Alias added: GHSA-3wf4-68gx-mph8

References

Patch 1

https://github.com/firebase/firebase-js-sdk/pull/8056

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-11023

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences