CVE-2024-54000 - CVE House

Back to Database

Status published High CVE-2024-54000

Mobile Security Framework (MobSF) bypass of SSRF fix

7.5 CVSS

Vulnerability Description

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-54000

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from MobSF

View All →

MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

MobSF Path Traversal in GET /download/<filename> using absolute filenames

Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack

Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding

Affected Vendor

MobSF

View all reports →

Affected Software

Mobile-Security-Framework-MobSF

Vulnerable Versions:

< 3.9.7

Timeline

Official Publish: December 3rd, 2024

Last Modified: December 3rd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1046 Network Service Discovery