GHSA-hqjr-43r5-9q58 MobSF has SQL Injection in its SQLite Database Viewer Utils

• PyPI mobsf: < 4.4.6 → fixed in 4.4.6

Description MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafted SQLite database, attacker-controlled table names are interpolated directly into SQL queries without parameterization or escaping. This allows an attacker to: 1. Cause Denial of Service -- A malicious table name causes the database viewer to crash, preventing the analyst from viewing ANY data in the SQLite database. A malicious app can use this to hide sensitive data (C2 server URLs, stolen credentials, API keys) from MobSF's analysis. 2. Achieve SQL Injection -- The `SELECT * FROM` query on line 557 is provably injectable via `UNION SELECT`, allowing attacker-controlled data to be returned in query results. The current code structure (a `PRAGMA` statement that runs first on line 553) limits the full exploitation chain, but the underlying code is verifiably injectable. Root Cause The vulnerable code in `mobsf/MobSF/utils.py:542-566`: ```python def read_sqlite(sqlite_file): """Sqlite Dump - Readable Text.""" table_dict = {} try: con = sqlite3.connect(sqlite_file) cur = con.cursor() cur.execute('SELECT name FROM sqlite_master WHERE type=\'table\';') tables = cur.fetchall() for table in tables: table_dict[table[0]] = {'head': [], 'data': []} cur.execute('PRAGMA table_info(\'%s\')' % table) # click app_data.db 4. Observe: database viewer fails (DoS) ``` PoC Output (Abbreviated) ``` [STEP 2] Running MobSF's read_sqlite() against malicious database... [!] EXCEPTION CAUGHT: OperationalError: near "UNION": syntax error [!] DoS CONFIRMED: read_sqlite() crashed [STEP 3] Demonstrating SELECT * FROM injection in isolation... Query: SELECT * FROM 'x' UNION SELECT 'SQL_INJECTION_PROOF'--' [+] Query executed successfully! [+] Results: [('SQL_INJECTION_PROOF',), ('normal_data',)] [+] SQL INJECTION CONFIRMED [STEP 4] Complete DoS (malicious table created first): Tables with data: NONE [!] COMPLETE DoS CONFIRMED ``` Suggested Fix Replace string formatting with properly quoted identifiers. SQLite uses double quotes for identifiers: ```python def read_sqlite(sqlite_file): """Sqlite Dump - Readable Text.""" table_dict = {} try: con = sqlite3.connect(sqlite_file) cur = con.cursor() cur.execute('SELECT name FROM sqlite_master WHERE type=\'table\';') tables = cur.fetchall() for table in tables: table_name = table[0] # Properly escape table name as a double-quoted identifier safe_name = table_name.replace('"', '""') table_dict[table_name] = {'head': [], 'data': []} cur.execute(f'PRAGMA table_info("{safe_name}")') rows = cur.fetchall() for sq_row in rows: table_dict[table_name]['head'].append(sq_row[1]) cur.execute(f'SELECT * FROM "{safe_name}"') rows = cur.fetchall() for sq_row in rows: tmp_row = [] for each_row in sq_row: tmp_row.append(str(each_row)) table_dict[table_name]['data'].append(tmp_row) except Exception: logger.exception('Reading SQLite db') return table_dict ``` This escapes any double quotes wit…