CVE-2024-54000
HIGHMobSF < 3.9.7 assetlinks Redirect - Server-Side Request Forgery
Title source: manualDescription
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-m435-9v6r-v5f6
Scores
CVSS v3
7.5
EPSS
0.0023
EPSS Percentile
46.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-918
Status
published
Products (2)
opensecurity/mobile_security_framework
< 3.9.7
pypi/mobsf
0 - 3.9.7PyPI
Published
Dec 03, 2024
Tracked Since
Feb 18, 2026