CVE-2024-54000
📋 TL;DR
This vulnerability allows server-side request forgery (SSRF) in Mobile Security Framework (MobSF) versions before 3.9.7. Attackers can exploit a redirect handling flaw in the _check_url method to make unauthorized requests to internal systems. Users running vulnerable MobSF instances are affected.
💻 Affected Systems
- Mobile Security Framework (MobSF)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to other systems within the network.
Likely Case
Unauthorized access to internal HTTP services and potential information disclosure from internal endpoints.
If Mitigated
Limited impact with proper network segmentation and SSRF protections in place.
🎯 Exploit Status
Exploitation requires understanding of SSRF techniques and redirect manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.7
Vendor Advisory: https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-m435-9v6r-v5f6
Restart Required: No
Instructions:
1. Update MobSF to version 3.9.7 or later using pip: 'pip install --upgrade mobsf==3.9.7' 2. Verify the update completed successfully 3. No service restart required for this fix
🔧 Temporary Workarounds
Disable vulnerable endpoint
allTemporarily disable or restrict access to the endpoint using the _check_url method
Modify MobSF configuration to disable affected functionality
🧯 If You Can't Patch
- Implement network segmentation to isolate MobSF instances from sensitive internal services
- Deploy web application firewall rules to detect and block SSRF attempts
🔍 How to Verify
Check if Vulnerable:
Check MobSF version: if version is less than 3.9.7, the system is vulnerableCheck Version:
python -c "import mobsf; print(mobsf.__version__)" or check the MobSF web interfaceVerify Fix Applied:
Verify MobSF version is 3.9.7 or higher and test the _check_url method with redirect scenarios📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from MobSF to internal IP addresses
- Multiple 302 redirect responses from .well-known/assetlinks.json endpoints
Network Indicators:
- HTTP traffic from MobSF to unexpected internal services
- Patterns of redirect manipulation in requests
SIEM Query:
source='mobsf.log' AND (url LIKE '%.well-known/assetlinks.json%' OR http_status=302) AND dest_ip IN (internal_subnets)