CVE-2024-29190 MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)
An attacker can exploit missing input validation in MobSF to perform server-side request forgery, accessing internal services within the organization's infrastructure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29190?
CVE-2024-29190 is a high-severity server-side request forgery vulnerability in Mobile-Security-Framework-MobSF, published on 22 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames in `android:host`, so requests can also be sent to local hostnames. This can lead to server-side request forgery. An attacker can cause the server to make a connection to internal-only services within the organization's infrastructure. Commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77 has a hotfix for this issue.
Weakness: CWE-918
Which versions are affected by CVE-2024-29190?
4 open source packages ship an affected version, including mobsfscan and mobsf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mobsfscan PyPI | All versions | 0.3.8 |
mobsfscan PyPI | All versions | 0.3.8 |
mobsfscan PyPI | All versions | 0.3.8 |
mobsf PyPI | All versions | 3.9.7 |
Products include Opensecurity Mobile Security Framework.
How do I fix CVE-2024-29190?
Upgrade mobsfscan to 0.3.8 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-29190 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29190 exists.
Other vulnerabilities in Mobile-Security-Framework-MobSF
- CVE-2025-46335 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
- CVE-2025-24805 Local Privilege Escalation in MobSF
- CVE-2025-24803 Stored Cross-Site Scripting (XSS) in MobSF
- CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
- CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Sources
Also known as GHSA-wfgj-wrgh-h3r3, PYSEC-2024-257, PYSEC-2026-1677.