firebase-fcm-server-key-disclosure: Firebase Cloud Messaging - Server Key Disclosure

id: firebase-fcm-server-key-disclosure

info:
  name: Firebase Cloud Messaging - Server Key Disclosure
  author: 0x_Akoko
  severity: medium
  description: |
    Detected Firebase Cloud Messaging (FCM) legacy server keys were identified in client-side files. These keys can be used to send push notifications to any device.
  reference:
    - https://firebase.google.com/docs/cloud-messaging
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 5.4
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 3
  tags: firebase,google,fcm,server-key,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
      - "{{BaseURL}}/firebase-messaging-sw.js"
      - "{{BaseURL}}/manifest.json"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'AAAA[A-Za-z0-9_-]{7}:[A-Za-z0-9_-]{140}'

      - type: word
        part: body
        words:
          - "firebaseConfig"
          - "serverKey"
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: fcm-server-key
        part: body
        regex:
          - 'AAAA[A-Za-z0-9_-]{7}:[A-Za-z0-9_-]{140}'
# digest: 490a0046304402202133c448c51774e1f84f62b2a589da2b127fc08fee2228fbdeee12fa68c22d6302203a29166f22c0d1c1cbcb69c5426727871dcf4f9f3fe6ed397df46511e8c396cf:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.