CVE-2024-29190

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-29190
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames in `android:host`, so requests can also be sent to local hostnames. This can lead to server-side request forgery. An attacker can cause the server to make a connection to internal-only services within the organization's infrastructure. Commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77 has a hotfix for this issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link Permissions Required
https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77 Patch
https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3 Exploit Vendor Advisory
https://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link Permissions Required
https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77 Patch
https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:opensecurity:mobile_security_framework:*:*:*:*:*:*:*:*
History

30 Jun 2025, 13:10

Type Values Removed Values Added
CPE cpe:2.3:a:opensecurity:mobile_security_framework:*:*:*:*:*:*:*:*
First Time Opensecurity mobile Security Framework
Opensecurity
References () https://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link - () https://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link - Permissions Required
References () https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77 - () https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77 - Patch
References () https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3 - () https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3 - Exploit, Vendor Advisory

21 Nov 2024, 09:07

Type Values Removed Values Added
References () https://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link - () https://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link -
References () https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77 - () https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77 -
References () https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3 - () https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3 -
Summary
  • (es) Mobile Security Framework (MobSF) es un framework de prueba de penetración, análisis de malware y evaluación de seguridad capaz de realizar análisis estáticos y dinámicos. En la versión 3.9.5 Beta y anteriores, MobSF no realiza ninguna validación de entrada al extraer los nombres de host en `android:host`, por lo que las solicitudes también se pueden enviar a nombres de host locales. Esto puede provocar server-side request forgery. Un atacante puede hacer que el servidor establezca una conexión con servicios exclusivamente internos dentro de la infraestructura de la organización. Commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77 tiene una revisión para este problema.

22 Mar 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-22 23:15

Updated : 2025-06-30 13:10

NVD link : CVE-2024-29190

Mitre link : CVE-2024-29190

CVE.ORG link : CVE-2024-29190

JSON object : View

Products Affected

opensecurity

  • mobile_security_framework
CWE
CWE-918

Server-Side Request Forgery (SSRF)