PT-2025-5745 · Opensecurity+3 · Mobile Security Framework+2
Oleg Surnin
·
Published
2025-02-05
·
Updated
2026-03-19
·
CVE-2025-24803
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions:
Mobile Security Framework (MobSF) versions prior to 4.3.1
Description:
The issue concerns a stored cross-site scripting (XSS) vulnerability in the iOS Dynamic Analyzer functionality of the Mobile Security Framework (MobSF). According to Apple's documentation, bundle IDs must contain only alphanumeric characters, hyphens, and periods. However, an attacker can manually modify the
CFBundleIdentifier value in the Info.plist file to include special characters. The dynamic analysis.html file does not sanitize the received bundle value from Corellium, allowing an attacker to break the HTML context and achieve stored XSS. This could enable an attacker to perform actions as users, including administrative users. The vulnerability can be exploited by uploading a malicious application to Corellium.Recommendations:
For versions prior to 4.3.1, update to version 4.3.1 to resolve the issue. As a temporary workaround, consider using the
escapeHtml() function on the bundle variable to sanitize the input. Restrict access to the dynamic analysis.html file to minimize the risk of exploitation. Avoid using the CFBundleIdentifier value in the Info.plist file without proper sanitization until the issue is resolved.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mobile Security Framework
Mobile-Security-Framework-Mobsf
Mobsf