CVE-2025-24805: Local Privilege Escalation in MobSF
Product: Mobile Security Framework (MobSF) Version: 4.3.0 CWE-ID: CWE-269: Improper Privilege Management CVSS vector v.4.0: 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N) CVSS vector v.3.1: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Description: MobSF has a functionality of dividing users by roles. This functionality is not efficient, because any registered user can get API Token with all privileges. Impact: Information Disclosure Vulnerable component: Code output component (/sourcecode) Exploitation conditions: authorized user Mitigation: Remove token output in the returned js-script Researcher: Egor Filatov (Positive Technologies)
Research
Researcher discovered zero-day vulnerability «Local Privilege Escalation» in Mobile Security Framework (MobSF). To reproduce the vulnerability follow the steps below.
• A user with minimal privileges is required, so the administrator must create a user account
<img width="215" alt="fig1" src="https://github.com/user-attachments/assets/43e02a50-bdd9-48d9-9194-73946fcc56d9" />
Figure 1. Registration
• Go to static analysis of any application
<img width="1207" alt="fig2" src="https://github.com/user-attachments/assets/9ed141a7-a667-4a96-81fd-d81127874104" /> Figure 2. Static analysis
• Go to the code review of the selected application and get a token with all privileges in the response
<img width="1400" alt="fig3" src="https://github.com/user-attachments/assets/bf8b704b-9067-4861-a7d3-05ec119d9a3f" /> Figure 3. Token receiving
• This token can be used to retrieve dynamic analysis information that has not been accessed before.
!fig4 Figure 4. No access demonstration
<img width="1412" alt="fig5" src="https://github.com/user-attachments/assets/dc8f639f-36b0-47d3-807d-58ae551fcbfc" /> Figure 5. Token usage
As a result, the user is able to escalate the privileges.
Please, assign all credits to: Egor Filatov (Positive Technologies)
Other sources
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24805?
CVE-2025-24805 is classified as a high-severity vulnerability due to its potential impact on local user access privileges.
How do I fix CVE-2025-24805?
To fix CVE-2025-24805, upgrade the Mobile Security Framework to version 4.3.1 or later to mitigate the vulnerability.
What causes CVE-2025-24805?
CVE-2025-24805 is caused by a local user being able to misuse an access token for scopes they should not have access to.
Who is affected by CVE-2025-24805?
CVE-2025-24805 affects users of the Mobile Security Framework version below 4.3.1 across Android, iOS, and Windows platforms.
Is CVE-2025-24805 being actively exploited?
As of now, there are no confirmed reports of active exploitation specifically for CVE-2025-24805 in the wild.