CVE-2024-54000 Mobile Security Framework (MobSF) bypass of SSRF fix
Attackers can bypass SSRF protections in MobSF by exploiting redirect handling in URL checks, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-54000?
CVE-2024-54000 is a high-severity server-side request forgery vulnerability in Mobile-Security-Framework-MobSF, published on 3 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.
Weakness: CWE-918
Which versions are affected by CVE-2024-54000?
3 open source packages ship an affected version, including mobsf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mobsf PyPI | All versions | 3.9.7 |
mobsf PyPI | All versions | 3.9.7 |
mobsf PyPI | All versions | 3.9.7 |
Products include Opensecurity Mobile Security Framework.
How do I fix CVE-2024-54000?
Upgrade mobsf to 3.9.7 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-54000 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-54000 exists.
Other vulnerabilities in Mobile-Security-Framework-MobSF
- CVE-2025-46335 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
- CVE-2025-24805 Local Privilege Escalation in MobSF
- CVE-2025-24803 Stored Cross-Site Scripting (XSS) in MobSF
- CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
- CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Sources
Also known as GHSA-m435-9v6r-v5f6, PYSEC-2024-256.