Mobile Security Framework (MobSF) は、.a 静的ライブラリファイルに Zip Slip の脆弱性を抱えています

The Zip Slip vulnerability in MobSF's static analyzer allows an attacker to manipulate file extraction paths during the analysis of .a archive files. This bypasses the intended security measure, enabling the attacker to write files outside of the intended directory. Successful exploitation could lead to arbitrary code execution on the server hosting MobSF, potentially allowing for complete system compromise. The attacker could install malware, steal sensitive data, or disrupt services. This vulnerability is particularly concerning given MobSF's role in mobile application security analysis, where it handles potentially malicious code.

Organizations using MobSF for mobile application security analysis are at risk, particularly those running versions 3.9.7 or earlier. Shared hosting environments where MobSF is deployed could be especially vulnerable, as an attacker gaining access to one instance could potentially compromise the entire server. Teams relying on MobSF for automated security assessments should prioritize patching.

• python / server: Examine MobSF logs for unusual file extraction patterns, particularly those involving .a files. Look for file writes outside of the expected analysis directory.

find /opt/mobsf/ -type f -name '*.a' -printf '%P\n' | grep -v '/mobsf/StaticAnalyzer/temp/'

• python / server: Monitor file system integrity using tools like AIDE or Tripwire, focusing on the MobSF installation directory and temporary analysis directories. • generic web: Monitor MobSF server for unexpected file creation or modification within the application's data directories.

1. 2024-08-19Disclosure

   disclosure

1. 予約済み2024-08-12
2. 公開日2024-08-19
3. 更新日2024-08-20
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2024-43399 is to upgrade MobSF to version 4.0.7 or later, which includes the corrected Zip Slip protection. If upgrading is not immediately feasible, consider restricting access to the Static Libraries analysis functionality. Implement strict file system permissions to limit the impact of potential file writes outside the intended directory. Monitor MobSF logs for unusual file extraction activity. While a WAF cannot directly prevent this vulnerability, it can help detect and block malicious requests attempting to exploit it.