CVE-2023-28131 Expo SDK has an OAuth vulnerability
CriticalCVSS 9.6
EPSS 23.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm expo(npm) | < 48.0.0 | 48.0.0 |
| Expo.io Expo AuthSession module | All versions | No fix listed |
| expo software development kit | >= 45.0.0, < 48.0.0 | 48.0.0 |
References
- nvd.nist.gov third-party-advisory
- blog.expo.dev mitigation third-party-advisory
- www.darkreading.com
- github.com