CVE-2024-54000
CVE-2024-54000 · Mobile Security Framework (MobSF) bypass of SSRF fix
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.
CVSS 7.5 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
mobile-security-framework-mobsf
- Versions
- < 3.9.7: Affected
No fix published
mobsf PyPI
- Versions
- 3.2.6
- 3.2.7
- 3.2.8
- 3.2.9
- 3.3.3
- 3.3.5
- 3.4.0
- 3.4.3
- 3.4.6
- 3.5.0
- 3.6.0
- 3.6.9
- 3.7.6
- Affected ranges
- ECOSYSTEM: < 3.9.7
Update to 3.9.7
mobsf PyPI
- Versions
- 3.2.6
- 3.2.7
- 3.2.8
- 3.2.9
- 3.3.3
- 3.3.5
- 3.4.0
- 3.4.3
- 3.4.6
- 3.5.0
- 3.6.0
- 3.6.9
- 3.7.6
- Affected ranges
- GIT: < f22c584aa7d43527970c9da61eb678953cfc0a8e
- ECOSYSTEM: < 3.9.7
Update to 3.9.7