CVE-2024-31215

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31215
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716 Patch
https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373 Issue Tracking Patch
https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx Vendor Advisory
https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716 Patch
https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373 Issue Tracking Patch
https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:opensecurity:mobile_security_framework:*:*:*:*:*:*:*:*
History

30 Jun 2025, 13:04

Type Values Removed Values Added
References () https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716 - () https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716 - Patch
References () https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373 - () https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373 - Issue Tracking, Patch
References () https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx - () https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx - Vendor Advisory
First Time Opensecurity mobile Security Framework
Opensecurity
CPE cpe:2.3:a:opensecurity:mobile_security_framework:*:*:*:*:*:*:*:*

21 Nov 2024, 09:13

Type Values Removed Values Added
Summary
  • (es) Mobile Security Framework (MobSF) es una plataforma de investigación de seguridad para aplicaciones móviles en Android, iOS y Windows Mobile. Una vulnerabilidad SSRF en la lógica de verificación de la base de datos de Firebase. El atacante puede hacer que el servidor establezca una conexión con servicios exclusivamente internos dentro de la infraestructura de la organización. Cuando se carga una aplicación maliciosa en el analizador estático, es posible realizar solicitudes internas. Esta vulnerabilidad ha sido parcheada en la versión 3.9.8.
References () https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716 - () https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716 -
References () https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373 - () https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373 -
References () https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx - () https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx -

04 Apr 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-04 16:15

Updated : 2025-06-30 13:04

NVD link : CVE-2024-31215

Mitre link : CVE-2024-31215

CVE.ORG link : CVE-2024-31215

JSON object : View

Products Affected

opensecurity

  • mobile_security_framework
CWE
CWE-918

Server-Side Request Forgery (SSRF)