CVE-2024-54000: Mobile Security Framework (MobSF) bypass of SSRF fix
Summary The fix for the "SSRF Vulnerability on assetlinkscheck(actname, wellknowns)" vulnerability could potentially be bypassed.
Details Since the requests.get() request in the checkurl method is specified as allowredirects=True, if "https://mydomain.com/.well-known/assetlinks.json" returns a 302 redirect, subsequent requests will be sent automatically. If the redirect location is "http://192.168.1.102/user/delete/1", a request will be sent here as well.
<img width="610" alt="image" src="https://github.com/MobSF/Mobile-Security-Framework-MobSF/assets/150332295/a8c9630e-3d12-441a-816c-8f5e427a5194">
It will be safer to use allowredirects=False.
Impact The attacker can cause the server to make a connection to internal-only services within the organization's infrastructure.
Other sources
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the checkurl method is specified as allowredirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-54000?
CVE-2024-54000 is considered high severity due to its potential for unauthorized redirection and information leakage.
How do I fix CVE-2024-54000?
To fix CVE-2024-54000, update Mobile Security Framework MobSF to version 3.9.7 or later.
What versions of MobSF are affected by CVE-2024-54000?
Versions of MobSF prior to 3.9.7 are affected by CVE-2024-54000.
Can CVE-2024-54000 be exploited remotely?
Yes, CVE-2024-54000 can be exploited remotely if unpatched versions are used.
What mitigation strategies are recommended for CVE-2024-54000?
The primary mitigation strategy for CVE-2024-54000 is to ensure that MobSF is updated to the latest version.