CVE-2024-54000

Name of the Vulnerable Software and Affected Versions: Mobile Security Framework (MobSF) versions prior to 3.9.7

Description: The issue concerns a server-side request forgery vulnerability. It occurs when the requests.get() request in the check url method is set to allow redirects=True, allowing a redirect when a request to .well-known/assetlinks.json returns a 302 redirect. This vulnerability is a bypass of a previous fix.

Recommendations: For versions prior to 3.9.7, update to version 3.9.7 to resolve the issue. As a temporary workaround, consider setting allow redirects=False in the requests.get() request of the check url method to prevent server-side request forgery. Restrict access to the check url method to minimize the risk of exploitation.