Vulnerability · Published Aug 19, 2024 · Assigned by GitHub_M
CVE-2024-43399Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files
High 8.0
In plain English
A high-severity security flaw in Mobile-Security-Framework-MobSF from MobSF. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the vulnerability allows an attacker to extract files to any desired location within the server running MobSF. This vulnerability is fixed in 4.0.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | mobsf | 4.0.7 | GHSA-4hh3-vj32-gr6j |
| PyPI | mobsf | 4.0.7 | PYSEC-2026-1665 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MobSF | Mobile-Security-Framework-MobSF | < 4.0.7 |
Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H