Description
Firebase is a mobile and web application development platform developed by Firebase, Inc. in 2011, then acquired by Google in 2014.
Any Firebase Realtime Database URL is accessible as a REST endpoint. All we need to do is append .json to the end of the URL and send a request from our favorite HTTPS client and we can access the data.
It was confirmed that this Firebase Realtime Database URL is accessible without authentication. If the database contains sensitive information it's recommended to restrict access to this database. Otherwise, you can ignore this alert.
Remediation
This Firebase Realtime Database URL is accessible without authentication. If the database contains sensitive information it's recommended to restrict access to this database.
References
Related Vulnerabilities
TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2009-3628)
RoR Database Configuration File Detected
Axis system configuration listing enabled in WEB-INF/server-config.wsdd
Apache ZooKeeper Unauthorized Access Vulnerability
WordPress Plugin WP-Invoice-Web Invoice and Billing Multiple Vulnerabilities (4.1.0)