CVE-2025-24805: Privilege Escalation in MobSF

The core of this vulnerability lies in MobSF's user role management system. The system lacks sufficient controls to prevent users from acquiring API tokens with elevated privileges. An attacker, simply by registering an account, can exploit this to gain full administrative access. This access can then be used to extract sensitive data, potentially including source code, configuration files, and other confidential information processed by MobSF. The impact is amplified if MobSF is used to analyze applications containing sensitive data, as the attacker could indirectly compromise those applications as well. There's a risk of lateral movement if the attacker can leverage the compromised MobSF instance to access other systems on the network.

1. Reserved2025-01-23
2. Published2025-02-05
3. EPSS updated2026-04-02

The primary mitigation for CVE-2025-24805 is to upgrade MobSF to version 4.3.1 or later, which addresses the privilege management flaw. If upgrading immediately is not feasible, consider temporarily restricting API token generation to administrators only. Implement stricter access controls and regularly audit user roles and permissions. Monitor MobSF logs for suspicious API token usage. While a direct WAF rule is unlikely, consider implementing rules to detect unusual API request patterns originating from newly registered users. After upgrading, confirm the fix by attempting to create a new user account and verifying that the generated API token does not grant administrative privileges.