Critical OAuth Vulnerability in Expo Framework That Leads To Account Hijacking

Summary:

Expo.io, an application development framework, has recently revealed a significant security vulnerability in its Open Authorization (OAuth) implementation. The identified vulnerability, labeled as CVE-2023-28131, has been assigned a high severity rating of 9.6 on the CVSS scoring system. According to researchers, this issue exposes services utilizing the framework to the risk of credential leakage. This vulnerability could potentially lead to unauthorized access to user accounts and the extraction of sensitive data. In specific scenarios, an attacker could exploit this flaw to carry out unauthorized actions on different platforms, including Facebook, Google, or Twitter, by impersonating a compromised user.[emaillocker id="1283"]

Vulnerability Exploitation Flow

Expo is an open-source platform that enables the development of universal native apps. It is important to highlight that in order for the attack to be effective, websites and applications utilizing Expo must have configured the AuthSession Proxy setting for single sign-on (SSO) with a third-party provider like Google or Facebook. This vulnerability could be exploited to redirect the secret token linked to a sign-in provider to a domain controlled by the attacker. Subsequently, the attacker could utilize the token to take control of the victim's account. To achieve this, the attacker manipulates the targeted user by enticing them to click on a specially crafted link. This link can be distributed through traditional social engineering methods such as email, SMS messages, or suspicious websites. By exploiting this vulnerability, a potential attacker could deceive a user into accessing a malicious link. Subsequently, the user might unknowingly log in to a third-party authentication provider, unknowingly exposing their credentials to the attacker. The reason for this vulnerability was that auth.expo.io used to retain an app's callback URL before the user explicitly confirmed their trust in the said URL.

Recommendations:

• We strongly recommend users migrate to directly registering deep link URL schemes with third-party authentication providers for SSO instead of using AuthSession API proxies.
  Refer this link: https://github.com/expo/fyi/blob/main/auth-proxy-migration.md

References:

The following reports contain further technical details:

https://thehackernews.com/2023/05/critical-oauth-vulnerability-in-expo.html