fix: mitmdump process leaked and respawned on every dynamic analysis run (#2658)

* fix: mitmdump process leaked and respawned on every dynamic analysis run

mobsf_agents_setup() called create_ca() unconditionally on every
dynamic analysis session, spawning a new detached mitmdump process
even when the CA cert already existed. The spawned process was also
never stopped, so it stayed running indefinitely after the session
ended.

create_ca() now waits for the CA cert file to appear and terminates
mitmdump once it's done, and the redundant unconditional call in
mobsf_agents_setup() is removed in favor of the existing
get_ca_file() check (already used by install_mobsf_ca()).

Co-authored-by: alanhasn

* reap mitmdump after CA generation

Co-authored-by: Ajin Abraham <[email protected]>

* Update environment.py

* Fix comment formatting in mobsf_agents_setup

Removed period from comment about installing MITM RootCA.

---------

Co-authored-by: Ajin Abraham <[email protected]>
Co-authored-by: Cursor Agent <[email protected]>

mobsf/DynamicAnalyzer/tools/webproxy.py

@@ -59,22 +59,48 @@ def start_httptools_ui(port):
     time.sleep(3)
 
 
+def _mitm_ca_file():
+    """Path to the mitmproxy generated CA cert."""
+    from mitmproxy import options
+    ca_dir = Path(options.CONF_DIR).expanduser()
+    return ca_dir / 'mitmproxy-ca-cert.pem'
+
+
 def create_ca():
     """Generate CA on first run."""
+    ca_file = _mitm_ca_file()
+    if ca_file.exists():
+        return
+
     argz = ['mitmdump', '-n']
-    subprocess.Popen(argz,
-                     stdin=None,
-                     stdout=None,
-                     stderr=None,
-                     close_fds=True)
-    time.sleep(3)
+    proc = subprocess.Popen(argz,
+                            stdin=subprocess.DEVNULL,
+                            stdout=subprocess.DEVNULL,
+                            stderr=subprocess.DEVNULL,
+                            close_fds=True)
+    try:
+        # mitmdump is only needed here to generate the CA cert. Stop it
+        # once the cert file appears instead of leaving it running as a
+        # leaked background process.
+        for _ in range(30):
+            if ca_file.exists() or proc.poll() is not None:
+                break
+            time.sleep(0.5)
+        if not ca_file.exists():
+            logger.warning('mitmproxy root CA generation failed.')
+    finally:
+        if proc.poll() is None:
+            proc.terminate()
+            try:
+                proc.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                proc.kill()
+                proc.wait()
 
 
 def get_ca_file():
     """Get CA Dir."""
-    from mitmproxy import options
-    ca_dir = Path(options.CONF_DIR).expanduser()
-    ca_file = ca_dir / 'mitmproxy-ca-cert.pem'
+    ca_file = _mitm_ca_file()
     if not ca_file.exists():
         create_ca()
     return ca_file.as_posix()

mobsf/DynamicAnalyzer/views/android/environment.py

@@ -18,7 +18,6 @@ from OpenSSL import crypto
 from frida import __version__ as frida_version
 
 from mobsf.DynamicAnalyzer.tools.webproxy import (
-    create_ca,
     get_ca_file,
     get_http_tools_url,
     start_proxy,
@@ -601,7 +600,6 @@ class Environment:
 
     def mobsf_agents_setup(self, agent):
         """Setup MobSF agents."""
-        create_ca()
         # Install MITM RootCA
         self.install_mobsf_ca('install')
         if agent == 'frida':