Skip to main content

Server-Side Request Forgery (SSRF)

CVE-2024-31215

Medium
4.3/10

Summary

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS, and Windows Mobile. An SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization's infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This issue mobsf versions through 3.9.7.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • REQUIRED
  • NONE
  • NONE
  • NONE

CWE-918 - Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.

References

Advisory Timeline

  • Published