CVE-2024-43399
📋 TL;DR
This vulnerability in MobSF allows attackers to bypass Zip Slip protections during static library analysis, enabling arbitrary file extraction to any location on the server. It affects all MobSF instances running versions before 4.0.7. Organizations using MobSF for mobile application security testing are at risk.
💻 Affected Systems
- Mobile Security Framework (MobSF)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via arbitrary file write leading to remote code execution, data exfiltration, or system takeover.
Likely Case
File system manipulation allowing attackers to overwrite critical files, install backdoors, or disrupt MobSF functionality.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are implemented.
🎯 Exploit Status
Exploitation requires uploading a malicious .a file to the MobSF instance, which can be done via the web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.7
Vendor Advisory: https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-4hh3-vj32-gr6j
Restart Required: Yes
Instructions:
1. Stop MobSF service. 2. Update to version 4.0.7 using pip: 'pip install --upgrade mobsf==4.0.7'. 3. Restart MobSF service.
🔧 Temporary Workarounds
Disable Static Libraries Analysis
allTemporarily disable the vulnerable static libraries analysis feature
Modify MobSF configuration to disable .a file processing
Network Isolation
allRestrict network access to MobSF instance
Configure firewall rules to limit access to trusted IPs only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MobSF from critical systems
- Run MobSF with minimal privileges and in a containerized environment
🔍 How to Verify
Check if Vulnerable:
Check MobSF version: if version < 4.0.7, system is vulnerableCheck Version:
python -c "import mobsf; print(mobsf.__version__)"Verify Fix Applied:
Verify version is 4.0.7 or higher and test .a file processing functionality📡 Detection & Monitoring
Log Indicators:
- Unusual .a file uploads
- File extraction errors
- Path traversal attempts in logs
Network Indicators:
- Unexpected outbound connections from MobSF server
- Large file transfers
SIEM Query:
source="mobsf.log" AND ("path traversal" OR ".a file" OR "extraction error")