CVE-2024-29190 json
MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)
published 2024-03-22 2 y ago modified 2026-07-07 4 mo ago also EUVD-2024-1024 , GHSA-wfgj-wrgh-h3r3 , PYSEC-2024-257 , PYSEC-2026-1677
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames in `android:host`, so requests can also be sent to local hostnames. This can lead to server-side request forgery. An attacker can cause the server to make a connection to internal-only services within the organization's infrastructure. Commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77 has a hotfix for this issue.
Patch / fix
- pypi mobsfscan 0.3.8
- pypi mobsf 3.9.7
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mobsfscan | <0.3.8 |
0.3.8 |
| pypi | mobsf | <3.9.7 |
3.9.7 |
Affected products
- MobSF Mobile-Security-Framework-MobSF
- mobsf mobile_security_framework
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77
web, patch
-
github.com
/MobSF/mobsfscan/commit/61fd40b477bbf9d204eb8c5a83a86c396d839798
web
-
github.com
/MobSF/mobsfscan/commit/cd01b71770a6e56c1c71b0e5f454e7b6c9c64ef4
web
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3
web, exploit, vendor-advisory, advisory, evidence
-
drive.google.com
/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link
web, permissions-required
-
nvd.nist.gov
/vuln/detail/CVE-2024-29190
advisory
-
github.com
/MobSF/Mobile-Security-Framework-MobSF
package
-
github.com
/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2024-257.yaml
web
-
pypi.org
/project/mobsfscan
package
-
github.com
/advisories/GHSA-wfgj-wrgh-h3r3
advisory
Sources
- CVE List CVE-2024-29190
- GitHub Advisory GHSA-wfgj-wrgh-h3r3
- NVD CVE-2024-29190
- OSV PYSEC-2024-257
- OSV PYSEC-2026-1677
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.