在 github.com/firebase/firebase-tools 的 firebase-tools emulator suite 中存在 CSRF 漏洞

The primary impact of this CSRF vulnerability lies within the Firebase Tools emulator suite. An attacker could craft a malicious website or link that, when visited by an authenticated user, would send unauthorized requests to the emulator. This could lead to unintended data modification, configuration changes, or other actions within the emulated Firebase environment. While the emulator itself doesn't directly impact production systems, it could compromise development workflows, testing environments, and potentially expose sensitive data used during development. The blast radius is limited to the emulator environment, but the potential for disruption and data exposure warrants prompt remediation.

1. 已保留2024-04-24
2. 发布日期2024-06-05
3. 修改日期2026-03-03
4. EPSS 更新日期2026-04-02

The recommended mitigation for CVE-2024-4128 is to immediately upgrade to Firebase Tools version 13.6.0 or later. This version includes a fix that prevents the CSRF vulnerability. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter authentication controls within the emulator environment. While not a direct fix, requiring multi-factor authentication (MFA) for emulator access can significantly reduce the risk of exploitation. Additionally, review any custom scripts or configurations used with the emulator to ensure they do not inadvertently expose sensitive data or functionality. After upgrading, confirm the fix by attempting to trigger a CSRF request against the emulator and verifying that it is blocked.