CVE-2024-29190: 
Python vulnerability analysis and mitigation

Mobile Security Framework (MobSF), a pen-testing, malware analysis and security assessment framework, was found to contain a Server-Side Request Forgery (SSRF) vulnerability (CVE-2024-29190). The vulnerability affects versions 3.9.5 Beta and prior, where MobSF fails to perform input validation when extracting hostnames in the android:host tag, allowing requests to be sent to local hostnames (GitHub Advisory, NVD).

The vulnerability stems from MobSF's lack of input validation when processing the 'android:host' tag within AndroidManifest.xml files. When examining the 'App Link assetlinks.json file could not be found' vulnerability, the framework sends GET requests to the '/.well-known/assetlinks.json' endpoint for all hosts specified in 'android:host' without proper validation. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (GitHub Advisory).

The vulnerability allows attackers to cause the server to make connections to internal-only services within an organization's infrastructure. This can lead to scanning of internal networks, potential data exfiltration, and could serve as an initial vector for further attacks targeting internal systems (Security Online).

The vulnerability can be exploited by manipulating the android:host parameter in the AndroidManifest.xml file. For example, setting android:host='192.168.1.102/user/delete/1#' allows requests to be sent to internal endpoints. The '#' character at the end of the host prevents requests from being sent to the '/.well-known/assetlinks.json' endpoint and ensures requests are sent to the endpoint before it (GitHub Advisory).

The vulnerability has been patched in MobSF version 3.9.7 and mobsfscan package version 0.3.8. Users are strongly advised to update to these versions immediately. The fix was implemented in commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77 (GitHub Commit).