Mobile Security Framework Mobsf
Monthly
Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated actions - including scan deletion, password changes, user creation/deletion, and file upload/download - against a logged-in victim's instance. The root cause is a Django migration regression: CsrfViewMiddleware was left in the deprecated MIDDLEWARE_CLASSES setting (ignored since Django 2.0) and never added to the active MIDDLEWARE tuple, leaving all POST endpoints unprotected. A working proof-of-concept is confirmed by the GHSA advisory reporter, who demonstrated complete scan deletion via a plain curl command using only a session cookie - no CSRF token required.
SSRF port restriction bypass in MobSF (Mobile Security Framework) prior to 4.5.1 allows authenticated high-privilege users to cause the server to make outbound HTTP requests to attacker-selected non-standard ports by uploading a crafted APK. The `get_browsable_activities()` function in `manifest_analysis.py` validates only the `android:host` attribute via `valid_host()`, which enforces a 80/443-only port allowlist, but then appends the separately supplied `android:port` attribute to the assembled URL without re-validating the combined result - enabling port restriction bypass. When combined with DNS rebinding between the validation lookup and the `requests.get()` connection, the outbound request can reach internal services; however, the path is fixed to `/.well-known/assetlinks.json` and redirects are disabled. No public exploit has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Arbitrary file read via path traversal in MobSF prior to 4.5.1 allows authenticated users with scan-upload permissions to exfiltrate server-side files by embedding traversal sequences in the android:icon attribute of a crafted AndroidManifest.xml inside a ZIP or APK upload. The vulnerable find_icon_path_zip() function resolves the attacker-controlled icon path without containment checks, copies the target file to a predictable location in DWD_DIR, and exposes it through the /download/ endpoint. A fully functional proof-of-concept script is publicly available in the GHSA advisory; this issue is not listed in the CISA KEV catalog.
Disk exhaustion via zip bomb bypass in MobSF prior to 4.5.1 allows any authenticated user to trigger uncontrolled resource consumption by uploading a crafted ZIP or APK whose member file exceeds 400 MB. The extraction function in shared_func.py logs a 'Skipping' warning but omits the continue statement, causing the oversized member to be written to disk regardless of the per-file size guard. A working proof-of-concept is embedded in the GitHub security advisory GHSA-x768-8642-mmq9; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated actions - including scan deletion, password changes, user creation/deletion, and file upload/download - against a logged-in victim's instance. The root cause is a Django migration regression: CsrfViewMiddleware was left in the deprecated MIDDLEWARE_CLASSES setting (ignored since Django 2.0) and never added to the active MIDDLEWARE tuple, leaving all POST endpoints unprotected. A working proof-of-concept is confirmed by the GHSA advisory reporter, who demonstrated complete scan deletion via a plain curl command using only a session cookie - no CSRF token required.
SSRF port restriction bypass in MobSF (Mobile Security Framework) prior to 4.5.1 allows authenticated high-privilege users to cause the server to make outbound HTTP requests to attacker-selected non-standard ports by uploading a crafted APK. The `get_browsable_activities()` function in `manifest_analysis.py` validates only the `android:host` attribute via `valid_host()`, which enforces a 80/443-only port allowlist, but then appends the separately supplied `android:port` attribute to the assembled URL without re-validating the combined result - enabling port restriction bypass. When combined with DNS rebinding between the validation lookup and the `requests.get()` connection, the outbound request can reach internal services; however, the path is fixed to `/.well-known/assetlinks.json` and redirects are disabled. No public exploit has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Arbitrary file read via path traversal in MobSF prior to 4.5.1 allows authenticated users with scan-upload permissions to exfiltrate server-side files by embedding traversal sequences in the android:icon attribute of a crafted AndroidManifest.xml inside a ZIP or APK upload. The vulnerable find_icon_path_zip() function resolves the attacker-controlled icon path without containment checks, copies the target file to a predictable location in DWD_DIR, and exposes it through the /download/ endpoint. A fully functional proof-of-concept script is publicly available in the GHSA advisory; this issue is not listed in the CISA KEV catalog.
Disk exhaustion via zip bomb bypass in MobSF prior to 4.5.1 allows any authenticated user to trigger uncontrolled resource consumption by uploading a crafted ZIP or APK whose member file exceeds 400 MB. The extraction function in shared_func.py logs a 'Skipping' warning but omits the continue statement, causing the oversized member to be written to disk regardless of the per-file size guard. A working proof-of-concept is embedded in the GitHub security advisory GHSA-x768-8642-mmq9; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.