PT-2025-19792 · Mobsf · Mobsf

Ssshah2131 · Published 2025-05-05 · Updated 2025-05-05 · CVE-2025-46730

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MobSF versions up to and including 4.3.2

Description MobSF is a mobile application security testing tool used by security teams across numerous organizations, typically deployed on centralized internal or cloud-based servers. The tool provides a feature that allows users to upload ZIP files for static analysis, which are automatically extracted and stored within the MobSF directory. However, this functionality lacks a check on the total uncompressed size of the ZIP file, making it vulnerable to a ZIP of Death (zip bomb) attack. An attacker can craft a specially prepared ZIP file that is small in compressed form but expands to a massive size upon extraction, exhausting the server's disk space and leading to a complete denial of service (DoS) not just for MobSF, but also for any other applications or websites hosted on the same server. This vulnerability can lead to complete server disruption in an organization, affecting other internal portals and tools too.

Recommendations For versions up to and including 4.3.2, update to a version that includes the fix, such as the version after commit 6987a946485a795f4fd38cebdb4860b368a1995d. As an additional mitigation, implement a safeguard that checks the total uncompressed size of any uploaded ZIP file before extraction, rejecting files that exceed a safe threshold, such as 100 MB, and notify the user.

Exploit

Fix

DoS

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2025-46730

GHSA-C5VG-26P8-Q8CR

Affected Products

Mobsf

References · 10

• 🔥 https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-c5vg-26p8-q8cr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46730.json · Exploit
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/6987a946485a795f4fd38cebdb4860b368a1995d · Patch
• https://osv.dev/vulnerability/CVE-2025-46730 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46730 · Security Note
• https://osv.dev/vulnerability/GHSA-c5vg-26p8-q8cr · Vendor Advisory
• https://github.com/MobSF/Mobile-Security-Framework-MobSF · Note
• https://twitter.com/CVEnew/status/1919479832012062932 · Twitter Post
• https://t.me/cvetracker/23080 · Telegram Post
• https://t.me/cvedetector/24503 · Telegram Post