PT-2024-36005 · Unknown · Mobile Security Framework

Ldomenx

·

Published

2024-12-03

·

Updated

2025-06-27

·

CVE-2024-53999

CVSS v3.1

8.1

High

VectorAV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions: Mobile Security Framework (MobSF) versions prior to 4.2.9
Description: The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the "Diff or Compare" functionality, they are affected by a Stored Cross-Site Scripting vulnerability. This issue occurs because the upload functionality allows users to upload files with special characters such as <, >, /, and " in the filename. The vulnerability can be exploited to steal information from other users or administrators when they perform the compare functionality.
Recommendations: For versions prior to 4.2.9, update to version 4.2.9 to fix the vulnerability. As a temporary workaround, consider restricting file uploads to filenames containing only whitelisted characters, such as A-Z, 0-9, and specific special characters permitted by business requirements, like - or . Additionally, avoid using the "Diff or Compare" functionality until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53999
GHSA-5JC6-H9W7-JM3P

Affected Products

Mobile Security Framework