CVE-2024-43399 Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files

2024-08-1914:44:47

CWE-23

GitHub_M

www.cve.org

mobsf

zip slip

vulnerability

static libraries

security assessment

flaw

pen-testing

malware analysis

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

38.4%

JSON

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the vulnerability allows an attacker to extract files to any desired location within the server running MobSF. This vulnerability is fixed in 4.0.7.

CNA Affected

[
  {
    "vendor": "MobSF",
    "product": "Mobile-Security-Framework-MobSF",
    "versions": [
      {
        "version": "< 4.0.7",
        "status": "affected"
      }
    ]
  }
]