Prototype Pollution

Overview @firebase/util is a wrapper of some Webchannel Features for the Firebase JS SDK. Affected versions of this package are vulnerable to Prototype Pollution. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker...

Node.js third-party modules: [@firebase/util] Prototype pollution

Module module name: @firebase/util version: 0.3.2 npm page: https://www.npmjs.com/package/@firebase/util Module Description NOTE: This is specifically tailored for Firebase JS SDK usage, if you are not a member of the Firebase team, please avoid using this package This is a wrapper of some...

app-context-connie (>=0.0.1 <=1.1.0), app-context-connie-firebase (>=0.0.1 <=0.0.3) +1 more potentially affected by CVE-2020-7706 via connie-lang (>=0.0.1 <=0.1.0)

connie-lang NPM version =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.2.1 Source cves: CVE-2020-7706 Source advisory: SNYK:JS-CONNIELANG-598853...

h1-ctf: [H1-2006] CTF Writeup

H1-2006 CTF Writeup I am fairly new to CTFs - this is just my second CTF after H1-415 CTF, at which I didn't get far at all. I think the most valuable thing I can do for anyone who comes across this writeup, is to describe exactly what I was thinking at each step along the way, including all my...

Crooks Tap Google Firebase in Fresh Phishing Tactic

A series of phishing campaigns using Google Firebase storage URLs have surfaced, showing that cybercriminals continue to leverage the reputation of Google’s cloud infrastructure to dupe victims and skate by secure email gateways. Google Firebase is a mobile and web application development platfor...

Google Firebase misconfiguration exposes data of 20k+ Android users

By Sudais Asif Up to 24000 Android apps may be at risk because of certain misconfiguration on... This is a post from HackRead.com Read the original post: Google Firebase misconfiguration exposes data of 20k+ Android users...

Over 4000 Android Apps Expose Users' Data via Misconfigured Firebase Databases

More than 4,000 Android apps that use Google's cloud-hosted Firebase databases are 'unknowingly' leaking sensitive information on their users, including their email addresses, usernames, passwords, phone numbers, full names, chat messages and location data. The investigation, led by Bob Diachenko...

Over 4000 Android Apps Expose Users' Data via Misconfigured Firebase Databases

More than 4,000 Android apps that use Google's cloud-hosted Firebase databases are 'unknowingly' leaking sensitive information on their users, including their email addresses, usernames, passwords, phone numbers, full names, chat messages and location data. The investigation, led by Bob Diachenko...

Hiding in plain sight: PhantomLance walks into a market

In July 2019, Dr. Web reported about a backdoor trojan in Google Play, which appeared to be sophisticated and unlike common malware often uploaded for stealing victims' money or displaying ads. So, we conducted an inquiry of our own, discovering a long-term campaign, which we dubbed "PhantomLance...

Firebase-Extractor - A Tool Written In Python For Scraping Firebase Data

This tool is written in python2, the purpose of this tool is to parse all the results from Bing search.Basically whenever a firebaseio URL is found for an app , User instead of searching for sensitive data by going manually through the search results can use this tool.This tool works by using the...

MobiSystems Ltd.: open Firebase Database: msdict-dev.firebaseio.com

Summary: publicly available Firebase Database msdict-dev.firebaseio.com Steps To Reproduce: Version: Oxford Dictionary of English Freev11.1.511 in res/values/strings.xml https://msdict-dev.firebaseio.com Accessing your Firebase Database via https://msdict-dev.firebaseio.com/.json returns null...

MobiSystems Ltd.: Firebase Firestore insecure database

Summary: The app is exposing a firebase database url that has no read/write protections. Steps To Reproduce: 1. Decompile the Android app 2. Do a string search for firebasedatabase 3. Use the project name i.e. msdict-dev in combination with the Firestore REST API to modify the database. Supportin...

X (Formerly Twitter): Periscope-all Firebase database takeover

Hello, I found one public Firebase database of periscope.tv and I can able to insert data to this database and i only used it once for the testing purposes, so other database queries also possible. Please follow the below link to check the inserted test data. Periscope-all Firebase URL :-...

Mac-Focused Malvertising Campaign Abuses Google Firebase DBs

A malvertising group named VeryMal that targets Mac users has changed up its tactics, ditching steganography as its obfuscation technique. Instead, it’s using ad tags that fetch a payload from Google Firebase in order to redirect users to malicious pop-ups. Confiant estimates that close to 1...

How was I to find Donald Daters applications database vulnerabilities-vulnerability warning-the black bar safety net

Monday night as usual I watch TV to pass the time, but there is nothing interesting in the program. So I decided on the phone looking for fun, I started aimlessly on Twitter through various tweets, a Fox News push content caught my attention. ! Someone of Trump's supporters developed a...

@askelephant/firebase-tools (>=15.4.0 <=15.5.1), @erosolarcoder/erosolar-coder (>=1.0.87 <=1.0.93) +32 more potentially affected by unknown CVE via superstatic (>=0.4.11 <=5.0.1)

superstatic NPM version =0.4.11, =15.4.0, =1.0.87, =2.0.0, =1.0.0-alpha.0, =0.1.1, =0.1.3, =1.0.0, =0.0.1, =2.0.0, =1.0.0, =0.1.0, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WM77-Q74P-5763...

Firebase Exploiting Tool - Exploiting Misconfigured Firebase Databases

Exploiting vulnerable/misconfigured Firebase databases Prerequisites Non-standard python modules: dnsdumpster bs4 requests Installation If the following commands run successfully, you are ready to use the script: git clone https://github.com/Turr0n/firebase.git cd firebase pip install -r...

CVE-2018-13850

The "Firebase Cloud Messaging FCM + Advance Admin Panel" component supporting Firebase Push Notification on iOS through 2017-10-26 allows SQL injection via the /advancepush/public/login username parameter...

Sql injection

The "Firebase Cloud Messaging FCM + Advance Admin Panel" component supporting Firebase Push Notification on iOS through 2017-10-26 allows SQL injection via the /advancepush/public/login username parameter...

CVE-2018-13850

The "Firebase Cloud Messaging FCM + Advance Admin Panel" component supporting Firebase Push Notification on iOS through 2017-10-26 allows SQL injection via the /advancepush/public/login username parameter...