Vulnerability · Published Apr 4, 2024 · Assigned by GitHub_M
CVE-2024-31215Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check
Medium 6.3
In plain English
A medium-severity server-side request forgery in Mobile-Security-Framework-MobSF from MobSF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | mobsf | 3.9.8 | GHSA-wpff-wm84-x5cx |
| PyPI | mobsf | 3.9.8 | PYSEC-2026-1676 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MobSF | Mobile-Security-Framework-MobSF | <= 3.9.7 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx x_refsource_CONFIRM
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373 x_refsource_MISC
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716 x_refsource_MISC