Firebase / Supabase Apps

Tags: firebase, supabase, idor, rules

Level: intermediate

Method

1. Pull the config

   apiKey, authDomain, projectId, databaseURL, storageBucket from JS or mobile. That is recon, not a finding.

   Tools: jsluice, getJS

2. Auth mode

   Open signup? Anonymous auth? Only OAuth? Try to create a user.

3. Rules

   Read/write on collections you should not see. Storage rules vs database rules often disagree.

4. IDOR in collections

   userId in the path, missing auth in a function, world-readable PII.

Field notes

• Do not dump the whole customer database. One other user's document is the PoC.
• Supabase RLS that is missing on one table is the same class of bug.

References

• https://firebase.google.com/docs/rules