Homepage

mobsf@4.3.0 vulnerabilities

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

  • latest version

    4.4.2

  • first published

    4 years ago

  • latest version published

    3 months ago

  • licenses detected

  • View mobsf package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the mobsf package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Improper Handling of Highly Compressed Data (Data Amplification)

    mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

    Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) through the ZIP file upload functionality. An attacker can exhaust the server's disk space, leading to a complete denial of service for MobSF and potentially other applications or websites hosted on the same server by crafting a specially prepared ZIP file that expands significantly upon extraction.

    How to fix Improper Handling of Highly Compressed Data (Data Amplification)?

    Upgrade mobsf to version 4.4.2 or higher.

    [0,4.4.2)
    • M
    Cross-site Scripting (XSS)

    mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper sanitization of user-supplied SVG files during the Android APK analysis workflow. An attacker can execute arbitrary scripts in the context of the MobSF user session by uploading a malicious SVG file as an app icon and accessing the publicly available URL.

    How to fix Cross-site Scripting (XSS)?

    Upgrade mobsf to version 4.4.2 or higher.

    [0,4.4.2)
    • L
    Server-side Request Forgery (SSRF)

    mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the valid_host function. An attacker can manipulate the DNS resolution process to bypass security checks by exploiting the DNS rebinding technique.

    Note:

    This is only exploitable if the system uses socket.gethostbyname() for DNS resolution, which does not adequately handle multiple rapid changes in DNS records.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade mobsf to version 4.3.2 or higher.

    [,4.3.2)
    • H
    Improper Privilege Management

    mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

    Affected versions of this package are vulnerable to Improper Privilege Management via the /source_code endpoint. An attacker can access sensitive information by obtaining an API token that grants all privileges, despite having minimal user rights.

    How to fix Improper Privilege Management?

    Upgrade mobsf to version 4.3.2 or higher.

    [,4.3.2)
    • H
    Improper Validation of Specified Type of Input

    mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

    Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input through the urls.py file where URL rules are defined. An attacker can cause the application to throw a 500 error and fail to display content by uploading a malicious application with a modified Info.plist file containing restricted characters in the CFBundleIdentifier key.

    How to fix Improper Validation of Specified Type of Input?

    Upgrade mobsf to version 4.3.2 or higher.

    [,4.3.2)
    • H
    Cross-site Scripting (XSS)

    mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the dynamic_analysis.html functionality. An attacker can perform actions as users, including administrative users, by uploading a malicious application to the Corellium platform and exploiting unsanitized input in the bundle identifier.

    How to fix Cross-site Scripting (XSS)?

    Upgrade mobsf to version 4.3.2 or higher.

    [,4.3.2)
    • H
    Insecure Permissions

    mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

    Affected versions of this package are vulnerable to Insecure Permissions due to missing access restrictions. An attacker can append /recent_scans/ to the URL after the homepage and gain access to APK or IPA reports, potentially leading to sensitive information disclosure.

    How to fix Insecure Permissions?

    There is no fixed version for mobsf.

    [0,)
    Go back to all versions of this package