CVE-2025-31116

The SSRF vulnerability in MobSF allows an attacker to craft malicious requests that appear to originate from within the MobSF environment. Because the mitigation relies on socket.gethostbyname(), which is susceptible to DNS rebinding, an attacker can manipulate DNS records to redirect requests to internal services or external hosts. This could lead to unauthorized access to sensitive data, including internal APIs, databases, or cloud resources. Successful exploitation could enable attackers to perform reconnaissance, escalate privileges, or even gain complete control over affected systems. The potential blast radius is significant, especially in environments where MobSF is used to analyze mobile applications with access to sensitive internal infrastructure.

Organizations using MobSF for mobile application security testing, particularly those with internal APIs or resources that are not publicly accessible, are at risk. Environments where MobSF is deployed with overly permissive network configurations or without proper access controls are especially vulnerable.

• python / server:

import socket
import dns.resolver

# Attempt DNS rebinding attack
resolver = dns.resolver.Resolver()
resolver.nameservers = ['127.0.0.1'] # Use local DNS server

try:
    answers = resolver.resolve('example.internal')
    print(answers)
except dns.resolver.NXDOMAIN: 
    print('NXDOMAIN')
except Exception as e:
    print(f'Error: {e}')

• generic web: Check MobSF logs for unusual outbound requests to internal or unexpected external IP addresses. Monitor network traffic for connections originating from MobSF to internal resources that should not be accessible.

1. 2025-03-31Disclosure

   disclosure

1. आरक्षित2025-03-26
2. प्रकाशित2025-03-31
3. संशोधित2026-02-04
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-31116 is to upgrade MobSF to version 4.3.2 or later, which includes a corrected implementation that prevents DNS rebinding attacks. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to block suspicious outbound requests, particularly those involving unusual hostnames or IP addresses. Additionally, restrict network access to MobSF to only authorized users and systems. Review and harden the network configuration to minimize the potential impact of a successful SSRF attack. After upgrading, confirm the fix by attempting a DNS rebinding attack against MobSF and verifying that the requests are properly blocked.