URL Redirection to Untrusted Site ('Open Redirect') Affecting mobsf package, versions [0,]
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-MOBSF-7577226
- published 1 Aug 2024
- disclosed 31 Jul 2024
- credit Marcin Węgłowski
Introduced: 31 Jul 2024
CVE-2024-41955 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
mobsf is a Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Affected versions of this package are vulnerable to URL Redirection to Untrusted Site ('Open Redirect') through the authentication view by manipulating the redirect URL after a successful login.
Note:* This is only exploitable if the authentication feature is enabled.
Workaround
Users that are unable to upgrade to the fixed version can disable the authentication feature