GHSA-m435-9v6r-v5f6
Suggest an improvement- Source
- https://github.com/advisories/GHSA-m435-9v6r-v5f6
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-m435-9v6r-v5f6/GHSA-m435-9v6r-v5f6.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-m435-9v6r-v5f6
- Aliases
- Published
- 2025-06-27T20:43:48Z
- Modified
- 2025-06-27T21:15:17.036662Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- MobSF vulnerability allows SSRF due to the allow_redirects=True parameter
- Details
-
Summary
The fix for the "SSRF Vulnerability on assetlinkscheck(actname, well_knowns)" vulnerability could potentially be bypassed.
Details
Since the requests.get() request in the checkurl method is specified as allow_redirects=True, if "https://mydomain.com/.well-known/assetlinks.json" returns a 302 redirect, subsequent requests will be sent automatically. If the redirect location is "http://192.168.1.102/user/delete/1", a request will be sent here as well.
<img width="610" alt="image" src="https://github.com/MobSF/Mobile-Security-Framework-MobSF/assets/150332295/a8c9630e-3d12-441a-816c-8f5e427a5194">
It will be safer to use allow_redirects=False.
Impact
The attacker can cause the server to make a connection to internal-only services within the organization's infrastructure.
- Database specific
{ "nvd_published_at": "2024-12-03T16:15:24Z", "cwe_ids": [ "CWE-918" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-06-27T20:43:48Z" }- References
-
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-m435-9v6r-v5f6
- https://nvd.nist.gov/vuln/detail/CVE-2024-54000
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/f22c584aa7d43527970c9da61eb678953cfc0a8e
- https://github.com/MobSF/Mobile-Security-Framework-MobSF
- https://github.com/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2024-256.yaml
Affected packages
PyPI / mobsf
Package
- Name
- mobsf
- View open source insights on deps.dev
- Purl
- pkg:pypi/mobsf