Description

MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an Android manifest android:host value with valid_host before appending a separately supplied android:port to the URL fetched by _check_url, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With an attacker-controlled hostname and DNS rebinding between validation and the requests.get connection, the request can reach an internal service, although redirects remain disabled and the path is fixed. This issue is fixed in version 4.5.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.0",
  "pubDate": "2026-08-18T18:19:28.350Z",
  "pubdate": "2026-08-18T18:19:28.350Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in MobSF prior to version 4.5.1 within the get_browsable_activities function located in mobsf/StaticAnalyzer/views/android/manifest_analysis.py.\nThe vulnerability allows an authenticated user who uploads a crafted APK to trigger arbitrary outbound HTTP requests from the server running MobSF to attacker-selected nonstandard ports.\nThe flaw stems from insufficient validation of Android manifest attributes where android:host is validated independently of a separately appended android:port value before being passed to the _check_url request handler.\nCombined with DNS rebinding techniques between the validation phase and the execution of the requests.get connection, an attacker can bypass hostname restrictions to probe internal services.\nAlthough redirects are disabled and the request path is restricted to a fixed location targeting /.well-known/assetlinks.json, the risk includes internal network scanning and potential interaction with internal endpoints.\nExploitation requires authentication to upload an adversarial APK and relies on network positioning capable of DNS rebinding attacks.",
  "technicalDetails": "The vulnerability resides in the manifest analysis component of MobSF, specifically within the get_browsable_activities function in the vulnerable file mobsf/StaticAnalyzer/views/android/manifest_analysis.py.\nThe root cause of the vulnerability is improper input validation and handling of Android manifest parameters during static analysis processing. Specifically, the validation logic utilizes the valid_host function to vet only the android:host value extracted from the manifest.\nHowever, a separately supplied android:port value is subsequently appended to the URL without equivalent rigorous validation before the URL is fetched by the _check_url function.\nAn authenticated user with privileges to upload APK files can craft a malicious application containing specifically manipulated browsable activity definitions within the Android manifest.\nDuring the static analysis of the uploaded APK, the vulnerable parsing logic constructs a target URL using the attacker-controlled host and port combination.\nBecause the validation of the host occurs separately from the final URL assembly and connection phase, an attacker can leverage DNS rebinding techniques.\nIn a DNS rebinding attack scenario, the domain name resolves to a legitimate or validated IP address during the initial validation check (valid_host), but resolves to an internal or sensitive IP address when the subsequent requests.get connection is actually established.\nConsequently, the server executes an HTTP GET request directed toward the attacker-specified nonstandard port and IP address, appending the fixed request path targeting /.well-known/assetlinks.json.\nAlthough HTTP redirects remain disabled and the request path cannot be arbitrarily modified beyond the fixed endpoint, the capability to direct server-side requests to internal endpoints poses a significant server-side request forgery risk.\nThe affected component is the Android manifest static analysis module in MobSF versions prior to 4.5.1, requiring an authenticated user session and the ability to upload a crafted APK file to initiate the attack flow."
}