CVE-2024-54000 Information
Description
Mobile Security Framework (MobSF) is a pen-testing malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7 the requests.get() request in the _check_url method is specified as allow_redirects=True which allows a server-side request forgery when a request to .well-known/assetlinks.json\ returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.
Reference
https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/f22c584aa7d43527970c9da61eb678953cfc0a8e
https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-m435-9v6r-v5f6
Mobile
Security
Framework
(MobSF)
is
a
pen-testing
malware
analysis
and
security
assessment
framework
capable
of
performing
static
and
dynamic
analysis.
In
versions
prior
to
3.9.7
the
requests.get()
request
in
the
_check_url
method
is
specified
as
allow_redirects=True
which
allows
a
server-side
request
forgery
when
a
request
to
.well-known/assetlinks.json
returns
a
302
redirect.
This
is
a
bypass
of
the
fix
for
CVE-2024-29190
and
is
fixed
in
3.9.7.