Executive brief
Expo's secure-store library on iOS applies an insecure credential storage policy when developers request protection for credentials that should only be accessible when the device is unlocked. This causes sensitive data like passwords and API keys to be stored with weak protection, allowing attackers with physical device access to extract credentials even if the device is locked.
Technical details
The secure-store module in Expo through version 9.1.0 uses an incorrect iOS Keychain security attribute when the WHEN_UNLOCKED_THIS_DEVICE_ONLY flag is specified. Instead of applying the secure kSecAttrAccessibleWhenUnlockedThisDeviceOnly policy, it applies kSecAttrAccessibleAlwaysThisDeviceOnly, which allows credential access even when the device is locked. This is a configuration error in the iOS native code. The vulnerability affects any application using Expo secure-store on iOS that relies on the WHEN_UNLOCKED_THIS_DEVICE_ONLY flag for credential protection. The fix was merged in pull request #9264 and available from version 9.1.0 onward.
Affected products
- Expo expo through 9.1.0
Timeline
- 2020-08-26: disclosed
- 2020-07-17: patched: Fix merged in PR #9264
- 2022-05-24: advisory