CVE-2026-68927: MobSF: SSRF port restriction bypass in assetlinks_check
MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by checkurl, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With an attacker-controlled hostname and DNS rebinding between validation and the requests.get connection, the request can reach an internal service, although redirects remain disabled and the path is fixed. This issue is fixed in version 4.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MobSFto a version that resolves this vulnerability.Fixed in 4.5.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Instances running MobSF before version 4.5.1 are affected when an authenticated user can upload an APK for static analysis. The issue is exposed through Android manifest processing in the assetlinks_check flow.
What does an attacker need to exploit this?
An attacker needs authenticated access and the ability to submit a crafted APK. Exploitation also requires an attacker-controlled hostname and DNS rebinding between hostname validation and the outbound requests.get connection.
What is the available remediation?
Upgrade MobSF to version 4.5.1. The provided data does not describe an alternative mitigation for installations that cannot be upgraded immediately.
How can I investigate possible exploitation?
Review whether APKs processed before upgrading contained crafted Android manifest host and port values that could cause requests to nonstandard ports. Relevant requests use the fixed path /.well-known/assetlinks.json and do not follow redirects.