MobSF 漏洞列表

MobSF is vulnerable to an issue with apktool (CVE-2024-21633) that allows for RCE or arbitrary file writing. It does this through a path traversal vulnerability. This template tests for it by writing to a local file and reading that file. RCE can be achieved by overwriting jadx, as shown in the two POCs listed as references. The payload for this template exists inside the binary format of an APK, which is a zip file. This means that a hardcoded random hex string is checked for, rather than a standard dynamic random string.

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view.

MobSF is vulnerable to an issue with apktool (CVE-2024-21633) that allows for RCE or arbitrary file writing. It does this through a path traversal vulnerability. This template tests for it by writing to a local file and reading that file. RCE can be achieved by overwriting jadx, as shown in the two POCs listed as references. The payload for this template exists inside the binary format of an APK, which is a zip file. This means that a hardcoded random hex string is checked for, rather than a standard dynamic random string.

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view.

MobSF Framework is exposed.

MobSF 是一个自动化的、一体化的移动应用程序（Android/iOS/Windows）渗透测试、恶意软件分析和安全评估框架，能够执行静态和动态分析。 MobSF 存在未经授权访问漏洞，可在主页后的 URL 中附加/recent_scans/即可查看应用程序列表访问 APK 或 IPA 报告，从而导致敏感信息泄露。