p PatchFirst

CVE-2024-31215

CVE-2024-31215 · Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.

CVSS 6.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • mobile-security-framework-mobsf

    Versions
    • <= 3.9.7: Affected

    No fix published

  • mobsf PyPI

    Versions
    • 3.2.6
    • 3.2.7
    • 3.2.8
    • 3.2.9
    • 3.3.3
    • 3.3.5
    • 3.4.0
    • 3.4.3
    • 3.4.6
    • 3.5.0
    • 3.6.0
    • 3.6.9
    • 3.7.6
    • 3.9.7
    Affected ranges
    • ECOSYSTEM: < 3.9.8

    Update to 3.9.8

Original sources

Check your server →