CVE-2024-54000

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Dec 3, 2024
CWE ID 918

Summary

CVE-2024-54000 is a new server-side request forgery vulnerability affecting the Mobile Security Framework (MobSF) version prior to 3.9.7. Unlike the previously fixed CVE-2024-29190, this issue arises due to the _check_url method's allow_redirects parameter being set to True. When a request to .well-known/assetlinks.json returns a 302 redirect, it bypasses the intended security enhancement, enabling attackers to carry out server-side requests. This vulnerability is resolved in MobSF version 3.9.7.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Mobile Security Framework

Affected Vendors

  • Open Security, Inc.

Advisories, Assessments, and Mitigations