CVE-2024-29190: MobSF Server-Side Request Forgery Vulnerability Due to Input Validation Flaw
Summary
CVE-2024-29190: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Affects mobsf across 2 version ranges.
< 3.9.7
< 5a8eeee73c5f504a6c3abdf2a139a13804efdb77
Fixed in 5a8eeee73c5f504a6c3abdf2a139a13804efdb77. How to fix ↓
Also tracked for
The same CVE-2024-29190 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mobile Security Framework (MobSF) is a comprehensive pen-testing, malware analysis, and security assessment framework designed for mobile applications. It supports both static and dynamic analysis, making it a valuable tool for security professionals. However, versions 3.9.5 Beta and earlier are vulnerable to a significant issue where the framework fails to validate input when extracting hostnames, allowing malicious requests to be sent to local hostnames.
Vulnerability Detail
The vulnerability arises from MobSF's lack of input validation in the android:host extraction process. This oversight can lead to server-side request forgery (SSRF), where an attacker can manipulate the server into making unauthorized requests to internal services within an organization's infrastructure. The implications of this vulnerability are severe, as it could expose sensitive internal resources to unauthorized access, potentially leading to data breaches or further exploitation.
How To Fix
Latest published version: 4.5.3 as of 23 Oct 2026
pip install --upgrade "mobsf==4.5.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5a8eeee73c5f504a6c3abdf2a139a13804efdb77
This is the first release that contains the fix.
pip install --upgrade "mobsf==5a8eeee73c5f504a6c3abdf2a139a13804efdb77"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing network-level controls to restrict access to internal services from the MobSF application. This can be done by configuring firewall rules or using a VPN to limit exposure to sensitive resources.
Conclusion
In summary, CVE-2024-29190 represents a critical vulnerability in MobSF that can lead to server-side request forgery due to inadequate input validation. It is essential for users to update to the patched version 3.9.7 or later to mitigate the risks associated with this vulnerability. Implementing additional network controls can also help protect sensitive internal resources.
See every vulnerability recorded for mobsf →
FAQ
CVE-2024-29190 is a vulnerability in MobSF that allows for server-side request forgery due to improper input validation.
This vulnerability can allow attackers to access internal services, potentially leading to data breaches or unauthorized access to sensitive information.
Versions 3.9.5 Beta and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mobsf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
