Firebase database accessible without authentication

[imhunterand]

Misconfigured Firebase Databases Exposing Data in Mobile Apps

Firebase is a mobile and web application development platform developed by Firebase, Inc. in 2011, then acquired by Google in 2014. Any Firebase Realtime Database URL is accessible as a REST endpoint. All we need to do is append .json to the end of the URL and send a request from our favorite HTTPS client and we can access the data. It was confirmed that this Firebase Realtime Database URL is accessible without authentication. If the database contains sensitive information it's recommended to restrict access to this database. Otherwise, you can ignore this alert.

Remediation This Firebase Realtime Database URL is accessible without authentication. If the database contains sensitive information it's recommended to restrict access to this database.

PoC: https://github.com/google/android-emulator-container-scripts/blob/e4cdba12f405b05fdf4d89d378e41d11ab632d81/js/firebase_config.json#L4

https://github.com/google/android-emulator-container-scripts/blob/e4cdba12f405b05fdf4d89d378e41d11ab632d81/js/firebase_config.json#L2

references : CWE-200 https://hackerone.com/reports/736283