Executive brief
MobSF is a mobile security analysis framework used to scan and analyze Android applications for security vulnerabilities. An authenticated attacker can upload a crafted APK that bypasses MobSF's port restrictions, causing the server to make outbound requests to attacker-controlled ports. When combined with DNS rebinding techniques, this can enable attacks against internal services that normally run on restricted ports (like SSH on port 22), potentially exposing internal infrastructure to unauthorized access.
Technical details
The vulnerability is a server-side request forgery (SSRF) bypass caused by separation of validation logic from URL assembly. The valid_host() function checks only the hostname component extracted from the Android manifest's android:host attribute, rejecting ports outside 80 and 443. However, the android:port attribute is extracted separately and concatenated into the final URL after the validation step, bypassing the port restrictions. The _check_url() function then performs only path/query/param validation before issuing the HTTP request via requests.get(). An authenticated attacker can craft an APK with a benign-looking hostname paired with a restricted port (e.g., port 22, 3389, 8080) in the manifest. Combined with DNS rebinding (where validation DNS resolution returns a public IP but the actual HTTP request resolves to an internal address), this enables SSRF to internal services. The fixed URL path (/.well-known/assetlinks.json) and disabled redirects (allow_redirects=False) limit the scope somewhat. MobSF versions before 4.5.1 are affected; version 4.5.1 and later contain patches.
Affected products
- MobSF Mobile Security Framework MobSF < 4.5.1
Timeline
- 2026-07-05: disclosed
- 2026-08-18: advisory
- 2026-08-18: patched: MobSF v4.5.1 released