{"id":"CVE-2024-54000","aliases":["EUVD-2024-52233","GHSA-m435-9v6r-v5f6","PYSEC-2024-256"],"status":"published","title":"Mobile Security Framework (MobSF) bypass of SSRF fix","description":"Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json\" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00413,"percentile":0.36043,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2024-12-03T15:33:56Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"PyPI","package":"mobsf","fixed_in":["3.9.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.7"}]}],"versions":["3.2.6","3.2.7","3.2.8","3.2.9","3.3.3","3.3.5","3.4.0","3.4.3","3.4.6","3.5.0","3.6.0","3.6.9","3.7.6"]},{"source":"osv","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"f22c584aa7d43527970c9da61eb678953cfc0a8e"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.7"}]}],"versions":["3.2.6","3.2.7","3.2.8","3.2.9","3.3.3","3.3.5","3.4.0","3.4.3","3.4.6","3.5.0","3.6.0","3.6.9","3.7.6"]}],"products":[{"vendor":"mobsf","product":"mobile-security-framework-mobsf"},{"vendor":"mobsf","product":"mobile_security_framework"},{"vendor":"opensecurity","product":"mobile_security_framework"}],"references":[{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-m435-9v6r-v5f6","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/f22c584aa7d43527970c9da61eb678953cfc0a8e","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54000","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2024-256.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m435-9v6r-v5f6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54000.json","tags":["advisory"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-54000","title":"Mobile Security Framework (MobSF) bypass of SSRF fix","description":"Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json\" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.","status":"published","published":"2024-12-03T15:33:56.232Z","modified":"2024-12-03T17:01:38.678Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:33:59.177173Z"}],"euvd":[{"id":"EUVD-2024-52233","description":"Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json\" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.","status":"published","published":"2024-12-03T15:33:56Z","modified":"2024-12-03T17:01:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:42.176683Z"}],"ghsa":[{"id":"GHSA-m435-9v6r-v5f6","title":"MobSF vulnerability allows SSRF due to the allow_redirects=True parameter","description":"### Summary\nThe fix for the \"SSRF Vulnerability on assetlinks_check(act_name, well_knowns)\" vulnerability could potentially be bypassed.\n\n### Details\nSince the requests.get() request in the _check_url method is specified as allow_redirects=True, if \"https://mydomain.com/.well-known/assetlinks.json\" returns a 302 redirect, subsequent requests will be sent automatically. If the redirect location is \"http://192.168.1.102/user/delete/1\", a request will be sent here as well.\n\n\u003cimg width=\"610\" alt=\"image\" src=\"https://github.com/MobSF/Mobile-Security-Framework-MobSF/assets/150332295/a8c9630e-3d12-441a-816c-8f5e427a5194\"\u003e\n\nIt will be safer to use allow_redirects=False.\n\n### Impact\nThe attacker can cause the server to make a connection to internal-only services within the organization's infrastructure.","status":"published","published":"2025-06-27T20:43:48Z","modified":"2025-06-27T20:43:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:38:47.835488Z"}],"nvd":[{"id":"CVE-2024-54000","description":"Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json\" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.","status":"published","published":"2024-12-03T16:15:24.38Z","modified":"2026-06-17T08:09:38.373Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:38.973941Z"}],"osv":[{"id":"CVE-2024-54000","title":"Mobile Security Framework (MobSF) bypass of SSRF fix","description":"Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json\" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.","status":"published","published":"2024-12-03T15:33:56.232Z","modified":"2026-10-28T02:30:29.756139624Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"GHSA-m435-9v6r-v5f6","title":"MobSF vulnerability allows SSRF due to the allow_redirects=True parameter","description":"### Summary\nThe fix for the \"SSRF Vulnerability on assetlinks_check(act_name, well_knowns)\" vulnerability could potentially be bypassed.\n\n### Details\nSince the requests.get() request in the _check_url method is specified as allow_redirects=True, if \"https://mydomain.com/.well-known/assetlinks.json\" returns a 302 redirect, subsequent requests will be sent automatically. If the redirect location is \"http://192.168.1.102/user/delete/1\", a request will be sent here as well.\n\n\u003cimg width=\"610\" alt=\"image\" src=\"https://github.com/MobSF/Mobile-Security-Framework-MobSF/assets/150332295/a8c9630e-3d12-441a-816c-8f5e427a5194\"\u003e\n\nIt will be safer to use allow_redirects=False.\n\n### Impact\nThe attacker can cause the server to make a connection to internal-only services within the organization's infrastructure.","status":"published","published":"2025-06-27T20:43:48Z","modified":"2025-06-27T21:15:17.036662Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"PYSEC-2024-256","description":"Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json\" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.","status":"published","published":"2024-12-03T16:15:24Z","modified":"2025-06-27T18:14:49.203947Z","updated_at":"2026-11-02T15:52:54.242332Z"}]}}