Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 1 March 2024.

Which products and versions are affected?

@sentry/react-native (npm) SEMVER:introduced=5.16.0,fixed=5.19.1; Sentry React Native SDK 5.16.0 through 5.19.0.

Is there a fix for This vulnerability?

Yes. @sentry/react-native (npm): upgrade to 5.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run @sentry/react-native (npm) or Sentry React Native SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Sentry React Native SDK auth token leakage in Expo plugin

Severity: info · Published 2024-03-01

The Sentry React Native SDK allows developers to configure authentication tokens for debugging purposes. Versions 5.16.0 through 5.19.0 incorrectly embed these tokens into compiled application bundles, which could expose the tokens if the app is published. An attacker with access to a published app bundle could extract the token and use it to compromise Sentry project data and settings.

Vendors: npm, Sentry.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 1 March 2024.
Which products and versions are affected?: @sentry/react-native (npm) SEMVER:introduced=5.16.0,fixed=5.19.1; Sentry React Native SDK 5.16.0 through 5.19.0.
Is there a fix for This vulnerability?: Yes. @sentry/react-native (npm): upgrade to 5.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run @sentry/react-native (npm) or Sentry React Native SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sentry/react-native (npm): upgrade to 5.19.1 or later
```
npm install @sentry/react-native@5.19.1
```

Technical details

This vulnerability is an information disclosure (CWE-200) affecting the Sentry React Native SDK's Expo plugin. The root cause is improper handling of the optional authToken configuration parameter during the application bundling process. When developers set authToken in the plugin configuration for debugging, it was embedded in the final application bundle rather than being removed or excluded. An attacker with access to the compiled app bundle (via reverse engineering or from public app stores) can extract the token. The vulnerability requires the developer to explicitly configure the authToken parameter and publish the resulting app. Patched in version 5.19.1, which now removes the authToken before bundling and issues a warning if the parameter is set.

Affected products

Sentry React Native SDK 5.16.0 through 5.19.0

Timeline

2024-03-01: disclosed
2024-03-01: patched: version 5.19.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.