CVE-2018-1000025: Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability
Summary
CVE-2018-1000025: Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability. Affects kreait/firebase-php versions >= 3.2.0, < 3.8.1. Fixed in 3.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jerome Gamez Firebase Admin SDK for PHP is a library that provides PHP developers with an interface to interact with Firebase services. It allows developers to authenticate users, manage user accounts, and perform various operations on the Firebase platform. The SDK is widely used in PHP applications that leverage Firebase functionality. However, versions 3.2.0 to 3.8.0 of the SDK are vulnerable to an Incorrect Access Control vulnerability.
Vulnerability Detail
The vulnerability exists in the src/Firebase/Auth/IdTokenVerifier.php file of the Firebase Admin SDK for PHP. It arises from a failure to verify the token signature, which allows an attacker to forge a JWT (JSON Web Token) with any email address and user ID. This means that an attacker, with knowledge of the victim's email address, can create a token that appears legitimate and gain unauthorized access to the victim's account. The impact of this vulnerability is significant as it can lead to unauthorized access and potential data breaches. The vulnerability has been assigned a CVSS score of 8.1 (High).
How To Fix
Minimum fixed version
3.8.1
This is the first release that contains the fix.
composer require kreait/firebase-php:3.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of the Firebase Admin SDK for PHP as soon as possible.
Conclusion
The Jerome Gamez Firebase Admin SDK for PHP versions 3.2.0 to 3.8.0 are vulnerable to an Incorrect Access Control vulnerability that allows an attacker to forge JWTs and gain unauthorized access to user accounts. To mitigate this vulnerability, developers should update to version 3.8.1 or later of the SDK. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kreait/firebase-php →
FAQ
The vulnerability allows an attacker to forge a JWT and gain unauthorized access to user accounts, potentially leading to data breaches and unauthorized actions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the fix for this vulnerability is available in version 3.8.1 of the Jerome Gamez Firebase Admin SDK for PHP. It is recommended to update to this version or later to mitigate the vulnerability.
No, there are no known workarounds for this vulnerability. Updating to the fixed version is the recommended solution.
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties. It is commonly used for authentication and authorization purposes in web applications.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
