Description

MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T18:19:28.053Z",
  "pubdate": "2026-08-18T18:19:28.053Z",
  "executiveSummary": "An omission of Cross-Site Request Forgery (CSRF) protection exists in Mobile Security Framework (MobSF) prior to version 4.5.1. The vulnerability stems from the misconfiguration of Django middleware settings within the application.\nSpecifically, the django.middleware.csrf.CsrfViewMiddleware is placed exclusively in the deprecated MIDDLEWARE_CLASSES setting while being completely omitted from the active MIDDLEWARE tuple.\nThis architectural oversight disables platform-level CSRF protections across the entire web interface. Consequently, remote attackers can construct malicious third-party web pages designed to coerce authenticated users into submitting unauthorized cross-site POST requests.\nSuccessful exploitation allows attackers to interact with sensitive authenticated web endpoints, resulting in unauthorized administrative and user-level state changes.\nThe risk implication is critical, as exploitation requires only that a logged-in victim visits a malicious web page or views crafted content, granting the attacker the ability to perform destructive actions or privilege escalation under the victim's security context without their consent.",
  "technicalDetails": "The root cause of this vulnerability lies in a misconfiguration within the Django framework settings file, specifically mobsf/MobSF/settings.py. Modern versions of the Django web framework utilize the active MIDDLEWARE tuple to process request and response middleware components globally.\nIn MobSF prior to version 4.5.1, the developer inadvertently placed the critical django.middleware.csrf.CsrfViewMiddleware within the deprecated MIDDLEWARE_CLASSES setting rather than the active MIDDLEWARE setting.\nBecause Django ignores deprecated middleware configuration structures in favor of the active tuple during runtime request handling, the CSRF validation middleware is never executed for incoming HTTP requests.\nThe vulnerable component is the HTTP request processing pipeline managed by the Django middleware architecture within MobSF.\nAffected systems include all instances of MobSF prior to version 4.5.1.\nThe vulnerability is exposed over the network, allowing remote attackers to target instances accessible via HTTP or HTTPS.\nExploitation requires the victim to be authenticated to the MobSF web application with an active session, but does not require direct privilege requirements from the attacker, as the malicious actions inherit the permissions of the victim.\nThe attack flow proceeds as follows: 1) An attacker identifies a target MobSF instance and maps critical authenticated POST endpoints, including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. 2) The attacker crafts a malicious external website or HTML payload containing automated form submissions or JavaScript fetch requests directed at these specific endpoints. 3) The attacker lures an authenticated MobSF user to the malicious web page via social engineering or other delivery mechanisms. 4) The victim's browser automatically includes active session cookies when dispatching the cross-origin HTTP POST requests to the MobSF server. 5) Due to the absence of the CsrfViewMiddleware, the MobSF server accepts and processes the incoming state-changing requests without validating anti-forgery tokens.\nPost-exploitation impact includes unauthorized deletion of scan reports, uploading malicious application binaries, downloading sensitive scan data, altering user account credentials, creating new unauthorized administrative accounts, or deleting existing user accounts."
}