CVE-2025-31116

An attacker exploiting CVE-2025-31116 can leverage DNS rebinding techniques to bypass the intended mitigation and initiate requests to internal services or resources that should be inaccessible from the outside. This could lead to unauthorized access to sensitive data, including API keys, database credentials, or internal network shares. The potential impact extends beyond simple information disclosure; an attacker could potentially use this SSRF vulnerability to perform actions on behalf of the MobSF server, such as executing commands or modifying data within internal systems. The blast radius is significant, potentially impacting any internal services accessible from the MobSF server.

Organizations using MobSF for mobile application security testing, particularly those with internal APIs or resources that are not publicly accessible, are at risk. Environments where MobSF is deployed with overly permissive network configurations or without proper access controls are especially vulnerable.

• python / server:

import socket
import dns.resolver

# Attempt DNS rebinding attack
resolver = dns.resolver.Resolver()
resolver.nameservers = ['127.0.0.1'] # Use local DNS server

try:
    answers = resolver.resolve('example.internal')
    print(answers)
except dns.resolver.NXDOMAIN: 
    print('NXDOMAIN')
except Exception as e:
    print(f'Error: {e}')

• generic web: Check MobSF logs for unusual outbound requests to internal or unexpected external IP addresses. Monitor network traffic for connections originating from MobSF to internal resources that should not be accessible.

1. 2025-03-31Disclosure

   disclosure

1. Reserviert2025-03-26
2. Veröffentlicht2025-03-31
3. Geändert2026-02-04
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-31116 is to upgrade MobSF to version 4.3.2 or later, which includes a corrected implementation of the valid_host() function. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) with rules to block suspicious DNS requests and restrict outbound connections from the MobSF server. Additionally, review and restrict network access rules to limit the MobSF server's ability to connect to external resources. After upgrading, verify the fix by attempting a DNS rebinding attack against the MobSF server and confirming that the request is blocked.