CVE-2024-29190 — Server-Side Request Forgery

Vendor	Product	Version range	Fixed in
mobsf	mobile-security-framework-mobsf	< 4.3.2	4.3.2
opensecurity	mobile_security_framework	< 3.9.7	3.9.7
opensecurity	mobile_security_framework	< 4.3.2	4.3.2

OSV

CVE-2025-31116: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analys

osv·2025-03-31·CVSS 7.5

CVE-2025-31116 [HIGH] CVE-2025-31116: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analys Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.

OSV

CVE-2024-54000: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analys

osv·2024-12-03·CVSS 7.5

CVE-2024-54000 [HIGH] CVE-2024-54000: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analys Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.

OSV

SSRF Vulnerability on assetlinks_check(act_name, well_knowns)

osv·2024-03-22

CVE-2024-29190 [HIGH] SSRF Vulnerability on assetlinks_check(act_name, well_knowns) SSRF Vulnerability on assetlinks_check(act_name, well_knowns) ### Summary While examining the "App Link assetlinks.json file could not be found" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the "/.well-known/assetlinks.json" endpoint for all hosts written with "android:host". In the AndroidManifest.xml file. Since MobSF does not perform any input validation when extracting the hostnames in "android:host", requests can also be sent to local hostnames. This may cause SSRF vulnerability. ### Details Example ``` We defined it as android:host="192.168.1.102/user/delete/1#". Here, the "#" character at the end of the host prevents requests from being sent to the "/.well-known/assetlinks.json" endpoint and ensures tha

GHSA

SSRF Vulnerability on assetlinks_check(act_name, well_knowns)

ghsa·2024-03-22

CVE-2024-29190 [HIGH] CWE-918 SSRF Vulnerability on assetlinks_check(act_name, well_knowns) SSRF Vulnerability on assetlinks_check(act_name, well_knowns) ### Summary While examining the "App Link assetlinks.json file could not be found" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the "/.well-known/assetlinks.json" endpoint for all hosts written with "android:host". In the AndroidManifest.xml file. Since MobSF does not perform any input validation when extracting the hostnames in "android:host", requests can also be sent to local hostnames. This may cause SSRF vulnerability. ### Details Example ``` We defined it as android:host="192.168.1.102/user/delete/1#". Here, the "#" character at the end of the host prevents requests from being sent to the "/.well-known/assetlinks.json" endpoint and ensures tha

OSV

CVE-2024-29190: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analys

osv·2024-03-22

CVE-2024-29190 CVE-2024-29190: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analys Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames in `android:host`, so requests can also be sent to local hostnames. This can lead to server-side request forgery. An attacker can cause the server to make a connection to internal-only services within the organization's infrastructure. Commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77 has a hotfix for this issue.

CVE-2024-29190: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In…

Affected

CVSS provenance