{"id":"CVE-2025-24805","aliases":["EUVD-2025-0235","GHSA-79f6-p65j-3m2m","PYSEC-2026-1667"],"status":"published","title":"Local Privilege Escalation in MobSF","description":"Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00364,"percentile":0.30678,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2025-02-05T18:41:02Z","modified":"2026-11-11T10:30:49Z","fixes":[{"ecosystem":"PyPI","package":"mobsf","fixed_in":["4.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1"}]}],"versions":["3.2.6","3.2.7","3.2.8","3.2.9","3.3.3","3.3.5","3.4.0","3.4.3","3.4.6","3.5.0","3.6.0","3.6.9","3.7.6","3.9.7","4.1.3","4.3.0"]},{"source":"osv","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1"}]}],"versions":["3.2.6","3.2.7","3.2.8","3.2.9","3.3.3","3.3.5","3.4.0","3.4.3","3.4.6","3.5.0","3.6.0","3.6.9","3.7.6","3.9.7","4.1.3","4.3.0"]}],"products":[{"vendor":"mobsf","product":"mobile-security-framework-mobsf"},{"vendor":"opensecurity","product":"mobile_security_framework"}],"references":[{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-79f6-p65j-3m2m","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/05206e72cae35b311615a70e51e1a946955c5e83","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24805","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-79f6-p65j-3m2m","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24805.json","tags":["advisory"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF","tags":["package"]},{"url":"https://pypi.org/project/mobsf","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-24805","title":"Local Privilege Escalation in MobSF","description":"Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-05T18:41:02.991Z","modified":"2025-02-12T19:41:05.811Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:32:44.11109Z"}],"euvd":[{"id":"EUVD-2025-0235","description":"Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-05T18:41:02Z","modified":"2025-02-12T19:41:05Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","level":"high"}],"updated_at":"2026-11-03T00:03:57.395516Z"}],"ghsa":[{"id":"GHSA-79f6-p65j-3m2m","title":"MobSF Local Privilege Escalation","description":"**Product:** Mobile Security Framework (MobSF)\n**Version:** 4.3.0\n**CWE-ID:** CWE-269: Improper Privilege Management\n**CVSS vector v.4.0:** 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N)\n**CVSS vector v.3.1:** 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)\n**Description:** MobSF has a functionality of dividing users by roles. This functionality is not efficient, because any registered user can get API Token with all privileges.\n**Impact:** Information Disclosure \n**Vulnerable component:** Code output component (`/source_code`)\n**Exploitation conditions:** authorized user\n**Mitigation:** Remove token output in the returned js-script\n**Researcher:** Egor Filatov (Positive Technologies)\n\n## Research \n\nResearcher discovered zero-day vulnerability «Local Privilege Escalation» in Mobile Security Framework (MobSF).\nTo reproduce the vulnerability follow the steps below.\n\n•\t A user with minimal privileges is required, so the administrator must create a user account\n\n\u003cimg width=\"215\" alt=\"fig1\" src=\"https://github.com/user-attachments/assets/43e02a50-bdd9-48d9-9194-73946fcc56d9\" /\u003e\n\n*Figure 1. Registration*\n\n•\tGo to static analysis of any application\n\n\u003cimg width=\"1207\" alt=\"fig2\" src=\"https://github.com/user-attachments/assets/9ed141a7-a667-4a96-81fd-d81127874104\" /\u003e\n \n*Figure 2. Static analysis*\n\n•\tGo to the code review of the selected application and get a token with all privileges in the response\n\n\u003cimg width=\"1400\" alt=\"fig3\" src=\"https://github.com/user-attachments/assets/bf8b704b-9067-4861-a7d3-05ec119d9a3f\" /\u003e\n \n*Figure 3. Token receiving*\n\n•\tThis token can be used to retrieve dynamic analysis information that has not been accessed before.\n\n![fig4](https://github.com/user-attachments/assets/fda8436b-de67-45b1-bb21-6cfbc9976f79)\n \n*Figure 4. No access demonstration*\n\n\u003cimg width=\"1412\" alt=\"fig5\" src=\"https://github.com/user-attachments/assets/dc8f639f-36b0-47d3-807d-58ae551fcbfc\" /\u003e\n \n*Figure 5. Token usage*\n\nAs a result, the user is able to escalate the privileges.\n\n\n_______________________\n\n### Please, assign all credits to: Egor Filatov (Positive Technologies)","status":"published","published":"2025-02-05T21:14:47Z","modified":"2025-02-26T08:24:34Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:38:33.163519Z"}],"nvd":[{"id":"CVE-2025-24805","description":"Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-05T19:15:46.487Z","modified":"2026-06-17T08:59:38.613Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:10:50.916773Z"}],"osv":[{"id":"CVE-2025-24805","title":"Local Privilege Escalation in MobSF","description":"Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-05T18:41:02.991Z","modified":"2026-11-11T10:30:49.189438974Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-11T11:06:32.539944Z"},{"id":"GHSA-79f6-p65j-3m2m","title":"MobSF Local Privilege Escalation","description":"**Product:** Mobile Security Framework (MobSF)\n**Version:** 4.3.0\n**CWE-ID:** CWE-269: Improper Privilege Management\n**CVSS vector v.4.0:** 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N)\n**CVSS vector v.3.1:** 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)\n**Description:** MobSF has a functionality of dividing users by roles. This functionality is not efficient, because any registered user can get API Token with all privileges.\n**Impact:** Information Disclosure \n**Vulnerable component:** Code output component (`/source_code`)\n**Exploitation conditions:** authorized user\n**Mitigation:** Remove token output in the returned js-script\n**Researcher:** Egor Filatov (Positive Technologies)\n\n## Research \n\nResearcher discovered zero-day vulnerability «Local Privilege Escalation» in Mobile Security Framework (MobSF).\nTo reproduce the vulnerability follow the steps below.\n\n•\t A user with minimal privileges is required, so the administrator must create a user account\n\n\u003cimg width=\"215\" alt=\"fig1\" src=\"https://github.com/user-attachments/assets/43e02a50-bdd9-48d9-9194-73946fcc56d9\" /\u003e\n\n*Figure 1. Registration*\n\n•\tGo to static analysis of any application\n\n\u003cimg width=\"1207\" alt=\"fig2\" src=\"https://github.com/user-attachments/assets/9ed141a7-a667-4a96-81fd-d81127874104\" /\u003e\n \n*Figure 2. Static analysis*\n\n•\tGo to the code review of the selected application and get a token with all privileges in the response\n\n\u003cimg width=\"1400\" alt=\"fig3\" src=\"https://github.com/user-attachments/assets/bf8b704b-9067-4861-a7d3-05ec119d9a3f\" /\u003e\n \n*Figure 3. Token receiving*\n\n•\tThis token can be used to retrieve dynamic analysis information that has not been accessed before.\n\n![fig4](https://github.com/user-attachments/assets/fda8436b-de67-45b1-bb21-6cfbc9976f79)\n \n*Figure 4. No access demonstration*\n\n\u003cimg width=\"1412\" alt=\"fig5\" src=\"https://github.com/user-attachments/assets/dc8f639f-36b0-47d3-807d-58ae551fcbfc\" /\u003e\n \n*Figure 5. Token usage*\n\nAs a result, the user is able to escalate the privileges.\n\n\n_______________________\n\n### Please, assign all credits to: Egor Filatov (Positive Technologies)","status":"published","published":"2025-02-05T21:14:47Z","modified":"2026-07-07T17:56:21.330903439Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"PYSEC-2026-1667","title":"MobSF Local Privilege Escalation","description":"**Product:** Mobile Security Framework (MobSF)\n**Version:** 4.3.0\n**CWE-ID:** CWE-269: Improper Privilege Management\n**CVSS vector v.4.0:** 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N)\n**CVSS vector v.3.1:** 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)\n**Description:** MobSF has a functionality of dividing users by roles. This functionality is not efficient, because any registered user can get API Token with all privileges.\n**Impact:** Information Disclosure \n**Vulnerable component:** Code output component (`/source_code`)\n**Exploitation conditions:** authorized user\n**Mitigation:** Remove token output in the returned js-script\n**Researcher:** Egor Filatov (Positive Technologies)\n\n## Research \n\nResearcher discovered zero-day vulnerability «Local Privilege Escalation» in Mobile Security Framework (MobSF).\nTo reproduce the vulnerability follow the steps below.\n\n•\t A user with minimal privileges is required, so the administrator must create a user account\n\n\u003cimg width=\"215\" alt=\"fig1\" src=\"https://github.com/user-attachments/assets/43e02a50-bdd9-48d9-9194-73946fcc56d9\" /\u003e\n\n*Figure 1. Registration*\n\n•\tGo to static analysis of any application\n\n\u003cimg width=\"1207\" alt=\"fig2\" src=\"https://github.com/user-attachments/assets/9ed141a7-a667-4a96-81fd-d81127874104\" /\u003e\n \n*Figure 2. Static analysis*\n\n•\tGo to the code review of the selected application and get a token with all privileges in the response\n\n\u003cimg width=\"1400\" alt=\"fig3\" src=\"https://github.com/user-attachments/assets/bf8b704b-9067-4861-a7d3-05ec119d9a3f\" /\u003e\n \n*Figure 3. Token receiving*\n\n•\tThis token can be used to retrieve dynamic analysis information that has not been accessed before.\n\n![fig4](https://github.com/user-attachments/assets/fda8436b-de67-45b1-bb21-6cfbc9976f79)\n \n*Figure 4. No access demonstration*\n\n\u003cimg width=\"1412\" alt=\"fig5\" src=\"https://github.com/user-attachments/assets/dc8f639f-36b0-47d3-807d-58ae551fcbfc\" /\u003e\n \n*Figure 5. Token usage*\n\nAs a result, the user is able to escalate the privileges.\n\n\n_______________________\n\n### Please, assign all credits to: Egor Filatov (Positive Technologies)","status":"published","published":"2026-07-07T14:34:49.397304Z","modified":"2026-07-07T17:47:05.769255852Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"}]}}