CVE-2025-31116
CVE-2025-31116 · Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.
CVSS 4.4 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
mobile-security-framework-mobsf
- Versions
- < 4.3.2: Affected
No fix published
mobsf PyPI
- Versions
- 3.2.6
- 3.2.7
- 3.2.8
- 3.2.9
- 3.3.3
- 3.3.5
- 3.4.0
- 3.4.3
- 3.4.6
- 3.5.0
- 3.6.0
- 3.6.9
- 3.7.6
- 3.9.7
- 4.1.3
- 4.3.0
- Affected ranges
- ECOSYSTEM: < 4.3.2
Update to 4.3.2
mobsf PyPI
- Versions
- 3.2.6
- 3.2.7
- 3.2.8
- 3.2.9
- 3.3.3
- 3.3.5
- 3.4.0
- 3.4.3
- 3.4.6
- 3.5.0
- 3.6.0
- 3.6.9
- 3.7.6
- 3.9.7
- 4.1.3
- 4.3.0
- v4.3.0
- v4.1.3
- v4.0.7
- v3.9.7
- v3.7.6
- v3.6.9
- v3.6.0
- v3.5.0
- v3.4.6
- v3.4.3
- v3.4.0
- v3.3.5
- v3.3.3
- v3.2.9
- v3.2.8
- v3.2.6
- v3.1.1
- v3.0.5
- v3.0.1
- v3.0.0
- v2.0.0
- v1.1.6
- v1.1.5
- v1.0.3Beta
- v0.9.5.5
- v0.9.5.4
- v0.9.5.2
- v0.9.5
- v0.9.4.2
- v0.9.4.1
- v0.9.4
- v0.9.3.7
- v0.9.3.6
- v0.9.3.5
- v0.9.3.3
- v0.9.3.2
- v0.9.3.1
- v0.9.3
- v0.9.2
- 0.9.1
- 0.9
- 0.8.8.2
- 0.8.8.1
- 0.8.8
- 0.8.7
- 0.8.6
- 0.8.5
- 0.8.4
- 0.8.3
- Affected ranges
- GIT: < 4b8bab5a9858c69fe13be4631b82d82186e0d3bd
- ECOSYSTEM: < 4.3.2
Update to 4.3.2