CVE-2024-4128: 
JavaScript vulnerability analysis and mitigation

CVE-2024-4128 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Firebase emulator suite. The vulnerability was discovered and disclosed on May 2, 2024, impacting versions prior to 13.6.0. The issue exists in the export endpoint that is used to export data from running emulators (NVD).

The vulnerability allows potential CSRF attacks through the export endpoint when running the Firebase emulator suite. The issue specifically affects users running the emulator who navigate to a malicious website using browsers that allow calls to localhost (such as Chrome versions before v94). The vulnerability has been assigned a CVSS v3.1 Base Score of 2.6 (LOW) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N, indicating network accessibility with high attack complexity, required low privileges, and user interaction (NVD).

If exploited, the vulnerability could allow malicious websites to exfiltrate data from running emulators when a user visits the site while running the Firebase emulator suite (NVD).

The vulnerability requires specific conditions to be exploited: the target must be running the Firebase emulator suite and must visit a malicious website using a browser that allows calls to localhost, such as Chrome versions prior to 94 (NVD).

Users are recommended to upgrade past version 13.6.0 or apply the fix from commit 068a2b08dc308c7ab4b569617f5fc8821237e3a0. The fix implements a security measure that blocks web browser requests to the export endpoint (Firebase Commit).