CVE-2020-24653: 
JavaScript vulnerability analysis and mitigation

The secure-store component in Expo through version 2.16.1 on iOS contains a security vulnerability where it incorrectly implements the security attribute for data storage. When developers specify the WHEN_UNLOCKED_THIS_DEVICE_ONLY policy, the system actually applies the less secure kSecAttrAccessibleAlwaysThisDeviceOnly policy instead (Expo PR, NVD).

The vulnerability stems from an implementation error in the iOS secure storage functionality where the wrong security attribute is applied. When developers request the WHEN_UNLOCKED_THIS_DEVICE_ONLY policy, which should restrict data access to only when the device is unlocked, the system instead applies kSecAttrAccessibleAlwaysThisDeviceOnly, one of the least secure options. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

This vulnerability could allow unauthorized access to sensitive data stored using the secure-store component, as the data remains accessible even when the device is locked. This significantly reduces the security of stored information, potentially exposing sensitive application data to unauthorized access (Expo PR).

The vulnerability affects all versions of Expo through 2.16.1 when used on iOS devices. The issue specifically impacts applications that use the secure-store component with the WHEN_UNLOCKED_THIS_DEVICE_ONLY policy (NVD).

Users should upgrade to a version of Expo newer than 2.16.1 which contains the fix for this vulnerability. The issue was addressed by correcting the security attribute to properly implement the WHEN_UNLOCKED_THIS_DEVICE_ONLY policy as intended (Expo PR, FortiGuard).