Vulnerability
vulnerability:firebase_security_rules_misconfiguration
Also: Firebase database exposure, debug settings left enabled
Improperly configured Firebase permit-and-allow rules that allowed unauthenticated access to application data.
Improperly configured Firebase permit-and-allow rules that allowed unauthenticated access to application data.
“The database had no security on it at all”
“They kept the debug settings on”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | AFFECTS | Firebase | Explicit | 49 |
| outgoing | DISCOVERED_BY | Elliot Alderson | Explicit | 49 |
| incoming | INVOLVES | Donald Daters database exposure | Explicit | 49 |
Firebase security rules misconfiguration AFFECTS Firebase
The Firebase database was exposed because debug settings and permissive security configuration were left enabled.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“They kept the debug settings on so it was pretty easy to get everything.”
“There was zip for permission and security there”
Donald Daters database exposure INVOLVES Firebase security rules misconfiguration
The Donald Daters database exposure involved Firebase debug/security settings being left open.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“This is a scandal because they kept the debug sitting on Firebase.”
Firebase security rules misconfiguration DISCOVERED_BY Elliot Alderson
Elliot discovered the Firebase exposure while inspecting the Donald Daters application.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Elliot took this Firebase URL that he found in the app and tried to see if he could see what’s in the Donald Dater’s database.”