| Package | Affected versions | Patched versions |
|---|---|---|
| mobsf | < 4.4.1 | 4.4.1 |
| mobile security framework | = 4.4.0 |
The vulnerability allows any user to overwrite any files available under the account privileges of the running process.
As part of static analysis, iOS MobSF supports loading and parsing statically linked libraries .a. When parsing such archives, the code extracts the embedded objects to the file system in the working directory of the analysis. The problem is that the current implementation does not prohibit absolute file names inside .a. If an archive item has a name like /abs/path/to/file, the resulting path is constructed as Path(dst) /name; for absolute paths, this leads to a complete substitution of the destination directory: writing occurs directly to the specified absolute directory. the path (outside the working directory).
Thus, an authenticated user who uploaded a specially prepared .a, can write arbitrary files to any directory writable by the user of the MobSF process (for example, /tmp, neighboring directories inside ~/.MobSF, etc.).
The key reason is that checking the "sliding" paths only takes into account the presence of .. (relative traversal), but does not take into account the absoluteness of the name and does not compare the normalized target path with the root directory of the extraction.
mobsf/StaticAnalyzer/views/common/shared_func.py
Function for extracting objects from .a — ar_extract
def ar_extract(checksum, src, dst):
"""Extract AR archive."""
...
ar = arpy.Archive(src)
ar.read_all_headers()
for a, val in ar.archived_files.items():
# Handle archive slip attacks
filtered = a.decode('utf-8', 'ignore')
if is_path_traversal(filtered):
msg = f'Zip slip detected. skipped extracting {filtered}'
logger.warning(msg)
append_scan_status(checksum, msg)
continue
out = Path(dst) / filtered
out.write_bytes(val.read())
.., %2e%2e, %252e./tmp/pwned.txt, outside the intended working directory.ar_extract is called from: mobsf/StaticAnalyzer/views/common/a.py
def extract_n_get_files(checksum, src, dst):
dst = Path(dst) / 'static_objects'
dst.mkdir(parents=True, exist_ok=True)
ar_extract(checksum, src, dst.as_posix())
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeThe expectation is that extraction happens only under the static_objects subdirectory, but absolute file names inside the .a break this assumption by directing writes outside that directory.
.a in MobSF.Using the script, create a file with the payload. In the example, this is "/home/mobsf/.MobSF/db.sqlite3"
<img width="786" height="342" alt="image" src="https://github.com/user-attachments/assets/0b7aee5c-6938-45cc-b668-9ad19f48c2c5" />Connect to the container and verify that the db.sqlite3 file is a database. The scan has not been performed yet.
<img width="2535" height="1507" alt="image" src="https://github.com/user-attachments/assets/0cc92da7-91c0-453f-b1ed-080c9cfaa7f1" />Upload the file for scanning and then update the page to get a server error.
<img width="2559" height="1476" alt="image" src="https://github.com/user-attachments/assets/a5b84ace-b853-46ad-9e2e-afad59ed058a" />Check the file structure after scanning and see that the file has been overwritten.
<img width="797" height="213" alt="image" src="https://github.com/user-attachments/assets/758ba3da-ae25-4c8d-bd8b-932573ca2306" />There is a database error in the MobSF log.
<img width="1724" height="1476" alt="image" src="https://github.com/user-attachments/assets/cd4211b1-2896-45e0-9934-9425b6035f2a" />Reject absolute paths and normalize before writing.