CVE-2023-28131: Expo SDK Auth Bypass Vulnerability

CVE-2023-28131 Overview

A vulnerability in the Expo framework allows attackers to take over user accounts and steal credentials on applications and websites that have configured the "Expo AuthSession Redirect Proxy" for social sign-in functionality. This authentication bypass vulnerability can be exploited when a victim clicks a malicious link, which can be delivered through various channels including email, text messages, or attacker-controlled websites.

Critical Impact

Successful exploitation enables complete account takeover and credential theft for applications using Expo's AuthSession proxy service, potentially affecting hundreds of third-party sites and mobile applications.

Affected Products

• Expo Software Development Kit (all versions using AuthSession Redirect Proxy)
• Applications using auth.expo.io proxy service
• Mobile and web applications configured with useProxy option in AuthSession

Discovery Timeline

• 2023-04-24 - CVE CVE-2023-28131 published to NVD
• 2025-02-04 - Last updated in NVD database

Technical Details for CVE-2023-28131

Vulnerability Analysis

This vulnerability stems from an OAuth implementation flaw in Expo's AuthSession redirect proxy service (auth.expo.io). When developers configure their applications to use the proxy service for social sign-in (OAuth flows with providers like Google, Facebook, etc.), the authentication tokens and credentials pass through Expo's redirect proxy. The vulnerability allows an attacker to intercept or redirect these authentication flows, capturing OAuth tokens and session credentials.

The flaw falls under CWE-522 (Insufficiently Protected Credentials), indicating that sensitive authentication data is not adequately protected during the OAuth redirect process. This architectural weakness means that any application relying on the Expo AuthSession proxy for OAuth authentication could have its users' credentials exposed to attackers.

Root Cause

The root cause lies in the design of the Expo AuthSession Redirect Proxy service at auth.expo.io. The proxy service insufficiently validates the redirect destinations and origin of authentication requests, allowing attackers to craft malicious URLs that redirect OAuth callbacks to attacker-controlled endpoints. This enables the theft of authentication tokens that should only be accessible to the legitimate application.

Attack Vector

The attack requires minimal attacker effort and leverages social engineering to deliver the malicious link to victims. The attack flow proceeds as follows:

1. An attacker identifies an application using Expo's AuthSession proxy (indicated by OAuth flows through auth.expo.io)
2. The attacker crafts a malicious authentication URL that exploits the redirect proxy vulnerability
3. The victim receives the link via email, SMS, social media, or visits an attacker-controlled website
4. When the victim clicks the link and attempts to authenticate, their OAuth tokens are redirected to the attacker
5. The attacker uses the captured tokens to gain full access to the victim's account

The attack is particularly dangerous because it occurs transparently during what appears to be a legitimate social login process. Users who regularly use "Sign in with Google" or similar OAuth options may not notice anything unusual until their accounts are compromised.

Detection Methods for CVE-2023-28131

Indicators of Compromise

• Unexpected OAuth authentication requests through auth.expo.io originating from suspicious referrers
• Authentication tokens being redirected to domains other than the legitimate application domain
• User reports of unauthorized account access following social sign-in attempts
• Suspicious redirect URLs containing manipulated callback parameters in application logs

Detection Strategies

• Monitor OAuth callback logs for redirect destinations that don't match your registered application domains
• Implement logging for all AuthSession authentication attempts and review for anomalous patterns
• Use web application firewalls (WAF) to detect and block malicious OAuth redirect manipulations
• Review application traffic for unusual authentication flows involving auth.expo.io

Monitoring Recommendations

• Enable verbose logging for OAuth authentication flows in your Expo application
• Set up alerts for authentication events with mismatched or unexpected redirect URIs
• Monitor user support tickets for reports of account compromise following social login
• Track changes to OAuth configuration and proxy settings in your deployment pipeline

How to Mitigate CVE-2023-28131

Immediate Actions Required

• Stop using the useProxy option in Expo AuthSession immediately
• Review and audit all social login implementations in your Expo applications
• Implement direct OAuth flows instead of relying on the Expo redirect proxy
• Notify users who may have been affected to reset their credentials and review account activity

Patch Information

Expo has addressed this vulnerability by recommending developers discontinue use of the auth.expo.io proxy service. Developers should migrate to direct OAuth implementations that do not rely on the redirect proxy. Detailed migration guidance is available in the Expo Blog Security Advisory.

Workarounds

• Remove useProxy: true from AuthSession configuration and implement direct OAuth flows with your identity providers
• Configure OAuth redirect URIs to point directly to your application's registered callback endpoints
• Use Expo's updated authentication patterns that bypass the vulnerable proxy service
• Consider implementing additional verification steps for social sign-in to detect potentially compromised sessions

To migrate away from the vulnerable proxy configuration, update your AuthSession implementation to use direct OAuth flows:

// Remove useProxy option and configure direct OAuth
// Old vulnerable configuration:
// const result = await AuthSession.startAsync({
//   authUrl: authUrl,
//   useProxy: true  // REMOVE THIS
// });

// Updated secure configuration - use direct OAuth redirect
import * as AuthSession from 'expo-auth-session';

const redirectUri = AuthSession.makeRedirectUri({
  native: 'your-app://redirect'
});

// Configure direct OAuth with your provider

For detailed migration instructions, refer to the Expo Blog Security Advisory and DarkReading OAuth Flaw Analysis for additional context on the vulnerability impact.