Firebase Database

What is Firebase

Firebase is a Backend-as-a-Services mainly for mobile application. It is focused on removing the charge of programming the back-end providing a nice SDK as well as many other interesting things that facilitates the interaction between the application and the back-end.

Pentest Methodology

Therefore, some Firebase endpoints could be found in mobile applications. It is possible that the Firebase endpoint used is configured badly grating everyone privileges to read (and write) on it.

This is the common methodology to search and exploit poorly configured Firebase databases:

1. Get the APK of app you can use any of the tool to get the APK from the device for this POC. You can use “APK Extractor” https://play.google.com/store/apps/details?id=com.ext.ui&hl=e

2. Decompile the APK using apktool, follow the below command to extract the source code from the APK.

3. Go to the res/values/strings.xml and look for this and search for “firebase” keyword

4. You may find something like this URL “https://xyz.firebaseio.com/”

5. Next, go to the browser and navigate to the found URL: https://xyz.firebaseio.com/.json

6. 2 type of responses can appear:

   1. “Permission Denied”: This means that you cannot access it, so it's well configured

   2. “null” response or a bunch of JSON data: This means that the database is public and you at least have read access.

      1. In this case, you could check for writing privileges, an exploit to test writing privileges can be found here: https://github.com/MuhammadKhizerJaved/Insecure-Firebase-Exploit

Interesting note: When analysing a mobile application with MobSF, if it finds a firebase database it will check if this is publicly available and will notify it.

Alternatively, you can use Firebase Scanner, a python script that automates the task above as shown below:

python FirebaseScanner.py -f <commaSeperatedFirebaseProjectNames>

Authenticated

If you have credentials to access the Firebase database you can use a tool such as Baserunner to access more easily the stored information. Or a script like the following:

#Taken from https://blog.assetnote.io/bug-bounty/2020/02/01/expanding-attack-surface-react-native/
import pyrebase

config = {
  "apiKey": "FIREBASE_API_KEY",
  "authDomain": "FIREBASE_AUTH_DOMAIN_ID.firebaseapp.com",
  "databaseURL": "https://FIREBASE_AUTH_DOMAIN_ID.firebaseio.com",
  "storageBucket": "FIREBASE_AUTH_DOMAIN_ID.appspot.com",
}

firebase = pyrebase.initialize_app(config)

db = firebase.database()

print(db.get())

To test other actions on the database, such as writing to the database, refer to the Pyrebase documentation which can be found here.

Access info with APPID and API Key

If you decompile the iOS application and open the file GoogleService-Info.plist and you find the API Key and APP ID:

• API KEY AIzaSyAs1[...]

• APP ID 1:612345678909:ios:c212345678909876

You may be able to access some interesting information

Request

curl -v -X POST "https://firebaseremoteconfig.googleapis.com/v1/projects/612345678909/namespaces/firebase:fetch?key=AIzaSyAs1[...]" -H "Content-Type: application/json" --data '{"appId": "1:612345678909:ios:c212345678909876", "appInstanceId": "PROD"}'

References

• https://blog.securitybreached.org/2020/02/04/exploiting-insecure-firebase-database-bugbounty/
• https://medium.com/@danangtriatmaja/firebase-database-takover-b7929bbb62e1