CVE-2025-24805: Mobsf MobSF Local Privilege Escalation Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-79f6-p65j-3m2m",
  "modified" : "2025-02-05T21:45:40Z",
  "published" : "2025-02-05T21:14:47Z",
  "aliases" : [ "CVE-2025-24805" ],
  "summary" : "MobSF Local Privilege Escalation",
  "details" : "**Product:** Mobile Security Framework (MobSF)\n**Version:** 4.3.0\n**CWE-ID:** CWE-269: Improper Privilege Management\n**CVSS vector v.4.0:** 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N)\n**CVSS vector v.3.1:** 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)\n**Description:** MobSF has a functionality of dividing users by roles. This functionality is not efficient, because any registered user can get API Token with all privileges.\n**Impact:** Information Disclosure \n**Vulnerable component:** Code output component (`/source_code`)\n**Exploitation conditions:** authorized user\n**Mitigation:** Remove token output in the returned js-script\n**Researcher:** Egor Filatov (Positive Technologies)\n\n## Research \n\nResearcher discovered zero-day vulnerability «Local Privilege Escalation» in Mobile Security Framework (MobSF).\nTo reproduce the vulnerability follow the steps below.\n\n•\t A user with minimal privileges is required, so the administrator must create a user account\n\n<img width=\"215\" alt=\"fig1\" src=\"https://github.com/user-attachments/assets/43e02a50-bdd9-48d9-9194-73946fcc56d9\" />\n\n*Figure 1. Registration*\n\n•\tGo to static analysis of any application\n\n<img width=\"1207\" alt=\"fig2\" src=\"https://github.com/user-attachments/assets/9ed141a7-a667-4a96-81fd-d81127874104\" />\n \n*Figure 2. Static analysis*\n\n•\tGo to the code review of the selected application and get a token with all privileges in the response\n\n<img width=\"1400\" alt=\"fig3\" src=\"https://github.com/user-attachments/assets/bf8b704b-9067-4861-a7d3-05ec119d9a3f\" />\n \n*Figure 3. Token receiving*\n\n•\tThis token can be used to retrieve dynamic analysis information that has not been accessed before.\n\n![fig4](https://github.com/user-attachments/assets/fda8436b-de67-45b1-bb21-6cfbc9976f79)\n \n*Figure 4. No access demonstration*\n\n<img width=\"1412\" alt=\"fig5\" src=\"https://github.com/user-attachments/assets/dc8f639f-36b0-47d3-807d-58ae551fcbfc\" />\n \n*Figure 5. Token usage*\n\nAs a result, the user is able to escalate the privileges.\n\n\n_______________________\n\n### Please, assign all credits to: Egor Filatov (Positive Technologies)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "mobsf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.3.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.3.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-79f6-p65j-3m2m"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-24805"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/05206e72cae35b311615a70e51e1a946955c5e83"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-269" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-02-05T21:14:47Z",
    "nvd_published_at" : "2025-02-05T19:15:46Z"
  }
}