Description
Firebase is a mobile and web application development platform developed by Firebase, Inc. in 2011, then acquired by Google in 2014.
Any Firebase Realtime Database URL is accessible as a REST endpoint. All we need to do is append .json to the end of the URL and send a request from our favorite HTTPS client and we can access the data.
It was confirmed that this Firebase Realtime Database URL is accessible without authentication. If the database contains sensitive information it's recommended to restrict access to this database. Otherwise, you can ignore this alert.
Remediation
This Firebase Realtime Database URL is accessible without authentication. If the database contains sensitive information it's recommended to restrict access to this database.
References
Related Vulnerabilities
Spring Boot Misconfiguration: H2 console enabled
WordPress Plugin Yoast SEO Information Disclosure (3.2.4)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-1159)
Content Security Policy (CSP) Nonce Without Matching Script Block
TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2009-0815)