Out Of Bounds Write in Firestore

Out Of Bounds Write (OOBW) in Firestore occurs when an application writes data beyond the intended boundaries of an array or collection, allowing attackers to modify data they shouldn't have access to. This vulnerability is particularly dangerous in Firestore because of its flexible document structure and array manipulation capabilities.

The most common Firestore OOBW patterns involve array operations that don't properly validate indices or array lengths. Consider this vulnerable pattern:

// Vulnerable: No bounds checking on array index
async function updateTaskStatus(docId, taskId, newStatus) {
  const doc = await db.collection('projects').doc(docId).get();
  const project = doc.data();
  
  project.tasks[taskId].status = newStatus; // No validation of taskId
  
  await db.collection('projects').doc(docId).update(project);
}

An attacker can exploit this by providing a taskId that exceeds the array length, potentially overwriting adjacent properties or creating new array elements. If the tasks array has 3 elements and the attacker provides taskId=10, they might overwrite the 4th element (creating it if it doesn't exist) or even modify other document properties if Firestore's internal storage allows it.

Another Firestore-specific OOBW pattern involves using arrayUnion and arrayRemove without proper authorization checks:

// Vulnerable: No ownership validation
async function addTagToDocument(docId, tag) {
  await db.collection('documents').doc(docId)
    .update({
      tags: firebase.firestore.FieldValue.arrayUnion(tag)
    });
}

// Attacker can add tags to any document
// If they know document IDs, they can tag documents they don't own

Firestore's FieldValue.arrayUnion() and FieldValue.arrayRemove() operations are atomic but don't perform authorization checks. An attacker who can guess or enumerate document IDs can modify any document's array fields, even if they shouldn't have access to those documents.

Nested array manipulation creates additional OOBW opportunities:

// Vulnerable nested array access
async function updateNestedArray(docId, outerIndex, innerIndex, newValue) {
  const doc = await db.collection('nested').doc(docId).get();
  const data = doc.data();
  
  data.outerArray[outerIndex].innerArray[innerIndex] = newValue;
  
  await db.collection('nested').doc(docId).update(data);
}

Without validating both outerIndex and innerIndex, attackers can traverse multiple levels of array nesting, potentially accessing and modifying data structures they shouldn't see. This becomes especially dangerous when combined with Firestore's ability to store complex nested objects.

Firestore's FieldValue.increment() operation can also lead to OOBW when used without proper validation:

// Vulnerable: No bounds on increment target
async function incrementCounter(docId, counterName, increment) {
  await db.collection('counters').doc(docId)
    .update({
      [counterName]: firebase.firestore.FieldValue.increment(increment)
    });
}

An attacker can manipulate counterName to target any numeric field in the document, potentially affecting counters they shouldn't be able to modify or even creating new numeric fields if the field doesn't exist.

Detecting Out Of Bounds Write vulnerabilities in Firestore requires both static code analysis and dynamic runtime testing. The most effective approach combines automated scanning with manual code review.

middleBrick's Firestore-specific detection includes 12 parallel security checks that identify OOBW patterns. The scanner tests unauthenticated endpoints by sending boundary values to array indices and monitoring for unexpected data modifications. For example, it will test array indices like -1, 0, array.length, and array.length+1 to identify boundary violations.

Key detection patterns middleBrick looks for:

{
  "out_of_bounds_write": {
    "severity": "high",
    "category": "Input Validation",
    "description": "Array index manipulation detected",
    "remediation": "Validate array indices against array length before access",
    "evidence": "Array index 15 provided for array of length 3"
  }
}

The scanner also tests Firestore's array operations by attempting to modify array fields on documents where the user shouldn't have permission. It uses a technique called