NewsPublished 23 Sep 2025

Tea continued · Unauthenticated access to 150+ Firebase databases, storage buckets and secrets

Source Reddit NetSec

Description

These aren't just random mobile apps with a few hundred or thousand downloads. Most of them had over 100K+, 1M+, 5M+, 10M+, 50M+, or even 100M+ downloads (Tea app only has 500K+ downloads). I’m also releasing OpenFirebase, an automated Firebase security scanner that checks for unauthorized read and/or write access on Firestore, Realtime Database, Storage Buckets, and Remote Config. It performs checks from both unauthenticated and/or authenticated perspectives, and it can bypass weak Google API key restrictions.

Impact

For European organizations, the impact of this threat can be substantial, especially for those relying on Firebase for critical mobile or web applications. Unauthorized access to Firebase databases and storage buckets can lead to exposure of personally identifiable information (PII), intellectual property, and sensitive configuration data, potentially violating GDPR and other data protection regulations. Data integrity may also be compromised if attackers modify or delete data, disrupting business operations or damaging customer trust. Additionally, exposure of secrets or API keys could facilitate further attacks on connected systems or services. The reputational damage and regulatory penalties resulting from such breaches could be severe. Given the scale of affected applications, the threat could impact a broad range of sectors including finance, healthcare, retail, and public services across Europe. The availability of an automated scanning tool like OpenFirebase lowers the barrier for attackers to identify vulnerable targets, increasing the likelihood of exploitation if organizations do not promptly audit and secure their Firebase configurations.

Defensive guidance

European organizations should implement the following specific mitigation measures: 1) Conduct comprehensive audits of all Firebase projects to verify that security rules enforce strict authentication and authorization, ensuring no unauthenticated read or write access is permitted. 2) Use Firebase’s built-in security rule simulator and logging features to test and monitor access patterns regularly. 3) Rotate and restrict API keys and service account credentials, applying the principle of least privilege and avoiding overly permissive API key restrictions. 4) Employ automated tools like OpenFirebase internally to proactively scan for misconfigurations before attackers can exploit them. 5) Integrate Firebase security checks into the CI/CD pipeline to prevent insecure configurations from reaching production. 6) Educate development teams on secure Firebase configuration best practices and the risks of misconfigured rules. 7) Implement anomaly detection and alerting for unusual access patterns to Firebase resources. 8) Ensure compliance with GDPR by promptly addressing any data exposure incidents and maintaining detailed access logs for forensic analysis. These steps go beyond generic advice by emphasizing continuous monitoring, automation, and developer education tailored to Firebase environments.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 23 Sep 2025, 18:46 UTC

Technical details

References

Community reviews

Related threats