Dangling Dns in Firestore

Dangling DNS in Firestore occurs when DNS records point to Firestore instances or services that have been decommissioned, misconfigured, or never properly secured. This creates a unique attack surface because attackers can discover these orphaned endpoints and attempt to access or manipulate data without proper authentication barriers.

In Firestore's architecture, dangling DNS often manifests through several specific patterns:

• Firestore instances that were once publicly accessible but had their access controls removed without updating DNS records
• Legacy Firestore endpoints still resolving to old IP addresses that no longer have proper security configurations
• Firestore emulators or development instances accidentally exposed through DNS entries
• Cloud Functions or Cloud Run services that interact with Firestore but have dangling DNS records pointing to them

The most common Firestore-specific dangling DNS scenario involves Cloud Firestore instances that were configured with public access for development or testing, then had their security rules updated to restrict access, but the DNS records were never updated to reflect the new security posture. Attackers can use tools like dig or nslookup to discover these endpoints and probe for authentication bypass opportunities.