Latoken Disclosed Report

latoken.com

I found your Firebase configuration on a javascript endpoint, the firebase is misconfigured, and an attacker can take over the firebase and tamper with the websites' static files.

1. Use a browser navigate to https://latoken.com/exch-static/js/main~82efc419.e072f64b.js, and you will find the firebase configuration as follows:

{apiKey:"AIzaSyAU4Vridk1SSi9J9HlAwCfCrgJV0jg4gy8",authDomain:"latoken.firebaseapp.com",projectId:"latoken",storageBucket:"latoken.appspot.com",messagingSenderId:"153493886861",appId:"1:153493886861:web:738f53b4a504572e090fc4",measurementId:"G-KMXZ7PRD53"}

2. Download the FirebaseMissconfig.html from the attachments, which is a PoC tool to demonstrate the bug. And use a browser open that html file, then input the ProjectID with latoken, and the ApiKey with AIzaSyAU4Vridk1SSi9J9HlAwCfCrgJV0jg4gy, and finally click the submit button twice, you will observe all websites' static files that were stored in the firebase storage, and a file named apoc.txt was uploaded to the firebase storage. It proved all static files in the firebase storage are vulnerable to tampering.

3. Please see my screenshot in the attachments.