Vendor: OPENSECURITY
Product: Mobile Security Framework (MobSF)
Vulnerable version: <=3.9.7
Vulnerability type:
- CWE-918: Server-Side Request Forgery (SSRF)
Identifier (ID):
Vulnerability vector:
- Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- Severity (CVSSv3.1): 6.3 (medium)
- Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
- Severity (CVSSv4.0): 5.3 (medium)
Description:
The vulnerability was identified in Mobile Security Framework (MobSF), versions <=3.9.7.
The discovered SSRF vulnerability in Firebase Database Check can be exploited by an attacker to make server connect to internal-only services. It is possible to make internal requests in case a malicious app is uploaded to Static analyzer.
Vulnerability status: Confirmed by vendor
Date of vulnerability detection: 02.04.2024
Recommendations: Update to version 3.9.8 or higher.
Additional information: Security Bulletin
Researcher: Oleg Surnin (Positive Technologies)
Get in touch
will contact you shortly