High, CVSS 7.3PyPIAmendedPublished
SSRF Vulnerability on assetlinks_check(act_name, well_knowns)
CVE-2024-29190 · GHSA-wfgj-wrgh-h3r3
- Affected
- PyPI mobsfscan < 0.3.8
- Fixed in
- 0.3.8· Vendor fix available
- Issue
- While examining the "App Link assetlinks.json file could not be found" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the "/.well-known/assetlinks.json" endpoint for all hosts written with "android:host". In the AndroidManifest.xml file. Since MobSF does not perform any input validation when extracting the hostnames in "android:host", requests can also be sent to local hostnames. This may cause SSRF vulnerability. Details Example <intent-filter structure in AndroidManifest.xml: We defined it as android:host="192.168.1.102/user/delete/1#". Here, the "#" character at the end of the host prevents requests from being sent to the "/.well-known/assetlinks.json" endpoint and ensures that requests are sent to the endpoint before it. <img width="617" alt="image" src="https://github.com/MobSF/Mobile-Security-Framework-MobSF/assets/150332295/c570cb00-e947-4ad7-af80-26d46c0ad3f7" PoC…
Recommended action: Upgrade to 0.3.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.