GitHub Advisoryadvisory · PyPI
GHSA-wpff-wm84-x5cx Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check
MEDIUM
Official page ↗
- Aliases
- CVE-2024-31215
- Ecosystem
- PyPI
- Packages
- mobsf
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-918
- Reviewed
- 2024-04-04
Affected packages
• PyPI mobsf: < 3.9.8 → fixed in 3.9.8
Description
Impact
_What kind of vulnerability is it? Who is impacted?_
SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When malicious app is uploaded to Static analyzer, it is possible to make internal requests.
Credits: Oleg Surnin (Positive Technologies).
Patches
_Has the problem been patched? What versions should users upgrade to?_
v3.9.8 and above
Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Code level patch
References
_Are there any links users can visit to find out more?_
https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373
Related
Alias · CVE (1)
- CVE-2024-31215 Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. vulnerability
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx web
- https://nvd.nist.gov/vuln/detail/CVE-2024-31215 advisory
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373 web
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716 web
- https://github.com/MobSF/Mobile-Security-Framework-MobSF package