Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check

TRUNG BÌNH 4.3CVE-2024-31215 · GHSA-wpff-wm84-x5cx · PYSEC-2026-1676 · Công bố 04/04/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-31215 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng mobsf, mobile security framework (opensecurity).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.51%, cao hơn 43.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.9.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
mobsf PyPI	`< 3.9.8`	`3.9.8`
mobile security framework opensecurity	`< 3.9.8`	`3.9.8`

Mô tả

Impact

What kind of vulnerability is it? Who is impacted? SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When malicious app is uploaded to Static analyzer, it is possible to make internal requests.

Credits: Oleg Surnin (Positive Technologies).

Patches

Has the problem been patched? What versions should users upgrade to? v3.9.8 and above

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading? Code level patch

References

Are there any links users can visit to find out more? https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373

Mô tả của NVD

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.