Vulnerability · Published Mar 31, 2025 · Assigned by GitHub_M

CVE-2025-31116Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding

Medium 4.4

In plain English

A medium-severity server-side request forgery in Mobile-Security-Framework-MobSF from MobSF. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.5%top 58.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	mobsf	4.3.2	GHSA-fcfq-m8p6-gw56
PyPI	mobsf	4.3.2	PYSEC-2025-48

Affected products (as reported)

Vendor	Product	Versions
MobSF	Mobile-Security-Framework-MobSF	< 4.3.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

References

https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-fcfq-m8p6-gw56 x_refsource_CONFIRM
https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/4b8bab5a9858c69fe13be4631b82d82186e0d3bd x_refsource_MISC