mobsf@3.6.9 vulnerabilities

mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) through the ZIP file upload functionality. An attacker can exhaust the server's disk space, leading to a complete denial of service for MobSF and potentially other applications or websites hosted on the same server by crafting a specially prepared ZIP file that expands significantly upon extraction.

Upgrade mobsf to version 4.4.2 or higher.

mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper sanitization of user-supplied SVG files during the Android APK analysis workflow. An attacker can execute arbitrary scripts in the context of the MobSF user session by uploading a malicious SVG file as an app icon and accessing the publicly available URL.

Upgrade mobsf to version 4.4.2 or higher.

mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the valid_host function. An attacker can manipulate the DNS resolution process to bypass security checks by exploiting the DNS rebinding technique.

Note:

This is only exploitable if the system uses socket.gethostbyname() for DNS resolution, which does not adequately handle multiple rapid changes in DNS records.

Upgrade mobsf to version 4.3.2 or higher.

mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Affected versions of this package are vulnerable to Improper Privilege Management via the /source_code endpoint. An attacker can access sensitive information by obtaining an API token that grants all privileges, despite having minimal user rights.

Upgrade mobsf to version 4.3.2 or higher.

mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input through the urls.py file where URL rules are defined. An attacker can cause the application to throw a 500 error and fail to display content by uploading a malicious application with a modified Info.plist file containing restricted characters in the CFBundleIdentifier key.

Upgrade mobsf to version 4.3.2 or higher.

mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the dynamic_analysis.html functionality. An attacker can perform actions as users, including administrative users, by uploading a malicious application to the Corellium platform and exploiting unsanitized input in the bundle identifier.

Upgrade mobsf to version 4.3.2 or higher.

mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper sanitization of special characters such as <, >, /, and " in the Diff or Compare functionality. An attacker can execute arbitrary scripts in the context of the user's browser.

Upgrade mobsf to version 4.3.0 or higher.

mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ar_extract function in the shared_func.py component during the extraction of .a extension files. This vulnerability derives due to improper user input sanitization, allowing an attacker to bypass existing protections using sequences like ....//....//....//.

Exploiting this vulnerability allows an attacker to write arbitrary files to any location on the server by manipulating the file path in the archive.

Upgrade mobsf to version 4.1.3 or higher.

mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Affected versions of this package are vulnerable to URL Redirection to Untrusted Site ('Open Redirect') through the authentication view by manipulating the redirect URL after a successful login.

Note:* This is only exploitable if the authentication feature is enabled.

Upgrade mobsf to version 4.1.3 or higher.

mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) due to the firebase database check logic. An attacker can cause the server to make connections to internal-only services within the organization's infrastructure by uploading a malicious app to the Static analyzer, enabling internal requests.

Upgrade mobsf to version 4.1.3 or higher.