Quick answers
- Is CVE-2023-28131 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-28131 being exploited in the wild.
- How severe is CVE-2023-28131?
- Low severity, with a CVSS score of 3.1, published 24 April 2023.
- Which products and versions are affected?
- expo (npm) SEMVER:introduced=0,fixed=48.0.0.
- Is there a fix for CVE-2023-28131?
- Yes. expo (npm): upgrade to 48.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-28131 attacked?
- It is attacked over the network.
- Am I affected by CVE-2023-28131?
- Check whether you run expo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- expo (npm): upgrade to 48.0.0 or later
npm install expo@48.0.0
Technical details
The vulnerability is an OAuth credential theft issue (CWE-522: Insufficient logging) in the Expo framework's AuthSession redirect proxy mechanism. When applications configure the "Expo AuthSession Redirect Proxy" for social sign-in, an attacker can craft a malicious link that, when clicked by a victim, intercepts and steals OAuth credentials or takes over the user's account. The attack requires user interaction (clicking a link) but has no authentication or privilege prerequisites and is delivered via network-accessible vectors (email, text, attacker-controlled websites). All versions prior to 48.0.0 are affected; version 48.0.0 and later include a fix.
Affected products
- Expo SDK before 48.0.0
Identifiers
- CVE-2023-28131
- GHSA-wr5g-q49g-548w
Timeline
- 2023-04-24: disclosed