published August 26, 2020
⚠️ A sneaky policy setting could leave your sensitive data exposed. If using Expo's secure-store on iOS versions up to 2.16.1, the kSecAttrAccessibleAlwaysThisDeviceOnly setting can be a real tripwire! Think of it like putting your valuables in a safe that’s only locked when you’re watching it. If someone can access your safe without your knowledge, that protection isn’t worth much! An attacker could potentially access sensitive data stored by your app while it remains unlocked, leading to unauthorized information exposure. This could be particularly damaging for applications handling private user data, making it essential to address this vulnerability!
Think of it like putting your valuables in a safe that’s only locked when you’re watching it. If someone can access your safe without your knowledge, that protection isn’t worth much! The vulnerability stems from Expo's secure-store on iOS, which incorrectly implements the kSecAttrAccessibleAlwaysThisDeviceOnly policy when using the WHEN_UNLOCKED_THIS_DEVICE_ONLY setting, allowing data access when the device is unlocked without proper checks.
An attacker could potentially access sensitive data stored by your app while it remains unlocked, leading to unauthorized information exposure. This could be particularly damaging for applications handling private user data, making it essential to address this vulnerability! To fortify your application, ensure that you upgrade to a version of Expo beyond 2.16.1, where this issue is resolved. Review your secure-store configurations to enhance data protection settings appropriately! You've got this! With these steps, you'll secure your app like a pro! 🛡️