GHSA-cxqq-w3x5-7ph3 MobSF Stored Cross-Site Scripting (XSS)

• PyPI mobsf: < 4.3.1 → fixed in 4.3.1

Product: MobSF Version: CFBundleIdentifier` value. In the `dynamic_analysis.html` file you do not sanitize received bundle value from Corellium https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/d1d3b7a9aeb1a8c8c7c229a3455b19ade9fa8fe0/mobsf/templates/dynamic_analysis/ios/dynamic_analysis.html#L406 *Figure 1. Unsanitized bundle* As a result, it is possible to break the HTML context and achieve Stored XSS. Vulnerability reproduction To reproduce the vulnerability, follow the steps described below. • Unzip the IPA file of any iOS application. *Listing 1. Unzipping the file* ``` unzip test.ipa ``` • Modify the value of `CFBundleIdentifier` by adding restricted characters in the `Info.plist` file. *Figure 2. Example of the modified Bundle Identifier* • Zip the modified IPA file. *Listing 2. Zipping the file* ``` zip -r xss.ipa Payload/ ``` • Upload the modified IPA file to your virtual device using the Correlium platform. *Figure 3. Example of the uploaded malicious application* • Open the XSS functionality and hover the mouse over the Uninstall button of the malicious app. *Figure 4. Example of the 'Uninstall' button* *Figure 5. Example of the XSS* *Figure 6. Example of the vulnerable code* ___________________________ Please, assign all credits to: Oleg Surnin (Positive Technologies)