CVE-2024-43399: Zip Slip in MobSF Static Analyzer

The Zip Slip vulnerability in MobSF's static analyzer allows an attacker to manipulate file extraction paths during the analysis of .a archive files. This bypasses the intended security measure, enabling the attacker to write files outside of the intended directory. Successful exploitation could lead to arbitrary code execution on the server hosting MobSF, potentially allowing for complete system compromise. The attacker could install malware, steal sensitive data, or disrupt services. This vulnerability is particularly concerning given MobSF's role in mobile application security analysis, where it handles potentially malicious code.

1. Reserved2024-08-12
2. Published2024-08-19
3. Modified2024-08-20
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-43399 is to upgrade MobSF to version 4.0.7 or later, which includes the corrected Zip Slip protection. If upgrading is not immediately feasible, consider restricting access to the Static Libraries analysis functionality. Implement strict file system permissions to limit the impact of potential file writes outside the intended directory. Monitor MobSF logs for unusual file extraction activity. While a WAF cannot directly prevent this vulnerability, it can help detect and block malicious requests attempting to exploit it.