gcp-firestore-modify-security-rules
firebase.rules.rulesets.create + firebase.rules.releases.update allows a principal to replace the active Firebase Security Rules with an attacker-controlled permissive ruleset, opening the Firestore database to internet access via the Firebase client SDK.
match (effective permission)
{
"action": "firebase.rules.rulesets.create",
"resource_type": "firebase.rules.Ruleset"
}
where
?principal ALSO has EFFECTIVE firebase.rules.releases.update (to promote the new ruleset to the live 'cloud.firestore' release)
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Firestore Database ResourcePolicy / firebase.rules.Release node> |
| permissions | firebase.rules.rulesets.create firebase.rules.releases.update |
| conditions | iam_permission |
| state logic | ACTIVE when both firebase.rules.rulesets.create and firebase.rules.releases.update are confirmed effective at the Firebase project scope and no IAM deny policy blocks them; CONDITIONAL(iam_permission) when one permission is uncertain. The resulting access change is IMMEDIATE — Firebase Security Rules updates propagate globally within ~1 minute of release update. No additional trigger is needed for the policy to take effect. |
Narrative
{principal.name} holds firebase.rules.rulesets.create and firebase.rules.releases.update on Firebase project {project.name} and can replace the active Firestore Security Rules with a permissive ruleset (e.g. 'allow read, write: if true'), immediately opening the Firestore database to unauthenticated internet access via the Firebase client SDK.
Raw rule rules/derived/gcp/firestore.yaml
id: gcp-firestore-modify-security-rules
emits: CanModifyPolicy
description: firebase.rules.rulesets.create + firebase.rules.releases.update allows a principal to replace
the active Firebase Security Rules with an attacker-controlled permissive ruleset, opening the Firestore
database to internet access via the Firebase client SDK.
match_effective_permission:
action: firebase.rules.rulesets.create
resource_type: firebase.rules.Ruleset
where:
- ?principal ALSO has EFFECTIVE firebase.rules.releases.update (to promote the new ruleset to the live
'cloud.firestore' release)
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Firestore Database ResourcePolicy / firebase.rules.Release node>
permissions:
- firebase.rules.rulesets.create
- firebase.rules.releases.update
conditions:
- iam_permission
state_logic: "ACTIVE when both firebase.rules.rulesets.create and firebase.rules.releases.update are\
\ confirmed effective at the Firebase project scope and no IAM deny policy blocks them; CONDITIONAL(iam_permission)\
\ when one permission is uncertain. The resulting access change is IMMEDIATE \u2014 Firebase Security\
\ Rules updates propagate globally within ~1 minute of release update. No additional trigger is needed\
\ for the policy to take effect."
confidence: min(contributing_confidences) * 0.94
derived_from:
- firebase.rules.rulesets.create effective permission
- firebase.rules.releases.update effective permission
false_positive_note: "This CanModifyPolicy edge represents the ability to replace Security Rules, which\
\ governs the FIREBASE CLIENT SDK surface only \u2014 not the Admin SDK / Cloud IAM surface. The resulting\
\ exposure (after a permissive ruleset is deployed) is emitted as ExposedToInternet by gcp-firestore-public-rules\
\ when the actual ruleset content is analyzed. Do NOT emit ExposedToInternet directly from this rule\
\ \u2014 that requires analyzing the DEPLOYED ruleset content. firebase.rules.rulesets.create alone\
\ is not sufficient: the new ruleset must also be promoted via firebase.rules.releases.update to become\
\ live. Without the release update the new ruleset is a draft and does not affect active access control.\
\ These permissions are included in roles/firebase.develop and roles/firebase.admin."
narrative: '{principal.name} holds firebase.rules.rulesets.create and firebase.rules.releases.update
on Firebase project {project.name} and can replace the active Firestore Security Rules with a permissive
ruleset (e.g. ''allow read, write: if true''), immediately opening the Firestore database to unauthenticated
internet access via the Firebase client SDK.'