CVE-2024-29190: SSRF Vulnerability Found in Popular Mobile App Testing Tool, MobSF

Security researchers have uncovered a serious vulnerability in the Mobile Security Framework (MobSF). MobSF is a widely used open-source tool for analyzing and testing the security of Android, iOS, and Windows Mobile applications.

The Vulnerability: What’s at Stake

The vulnerability (CVE-2024-29190) is classified as an SSRF (Server-Side Request Forgery) flaw. It could allow an attacker to trick the MobSF server into making requests to internal or otherwise inaccessible resources within your network. The consequences of this type of attack can range from:

• Scanning Internal Networks: An attacker could use SSRF to map out your organization’s internal network infrastructure, identifying other systems and servers that may be vulnerable to further attacks.
• Data Exfiltration: Sensitive data could be stolen from internal systems for malicious purposes.
• Launching Further Attacks: SSRF can be the first step in a chain of exploits, ultimately allowing an attacker to compromise internal systems or disrupt services.

How It Works

The vulnerability stems from MobSF’s lack of input validation when it processes the “android:host” tag within AndroidManifest.xml files. By injecting malicious hostnames, attackers can exploit MobSF to make requests to internal systems.

Who is Affected

Anyone using MobSF versions 3.9.5 Beta or earlier (or the Python package installer versions 0.3.7 or earlier) are vulnerable to this flaw.

The Fix: Update Immediately

The MobSF developers have released patched versions (3.9.7 and 0.3.8 in the Python package installer) to address CVE-2024-29190. If you utilize MobSF in your mobile development or security testing, it is urgent to update to the latest version as soon as possible.

Credit and PoC

Security researchers Enes Bulut and Yunus AYDIN have been credited with discovering the flaw and demonstrating how it could be exploited.

Protecting Yourself

• Update, Update, Update: The most crucial step is to update MobSF. Remember that software vulnerabilities are found all the time, so prioritize installing patches promptly.
• Defensive Network Practices: Apply robust network segmentation and access controls. This can help limit the potential damage of an SSRF exploit even if a vulnerability exists.
• Be Wary of User Input: Thorough input validation is essential, especially when dealing with user-supplied data that could include malicious hostnames.