Executive brief
Expo SDK, a popular framework for building mobile and web applications, contains an OAuth vulnerability in its AuthSession redirect proxy used for social sign-in. An attacker can hijack user accounts and steal login credentials by tricking users into clicking a malicious link, potentially affecting hundreds of third-party apps and websites built on the platform. This represents a significant risk to end-user account security and application integrity.
Technical details
The vulnerability is an OAuth credential theft issue (CWE-522: Insufficient logging) in the Expo framework's AuthSession redirect proxy mechanism. When applications configure the "Expo AuthSession Redirect Proxy" for social sign-in, an attacker can craft a malicious link that, when clicked by a victim, intercepts and steals OAuth credentials or takes over the user's account. The attack requires user interaction (clicking a link) but has no authentication or privilege prerequisites and is delivered via network-accessible vectors (email, text, attacker-controlled websites). All versions prior to 48.0.0 are affected; version 48.0.0 and later include a fix.
Affected products
- Expo SDK before 48.0.0
Timeline
- 2023-04-24: disclosed