* Harden path traversal checks for Windows root-relative escapes.
Reject POSIX/Windows absolute paths in is_path_traversal and require post-join containment at icon, network-config, and archive extraction sinks.
Co-authored-by: Cursor <[email protected]>
* Restrict network security config names to a basename.
CodeQL flagged the manifest-derived join; reduce the resource name first so path construction cannot escape xml_dir.
Co-authored-by: Cursor <[email protected]>
* Use os.path.basename for CodeQL-recognized path sanitization.
Path.name did not clear py/path-injection taint; basename plus existing containment checks keep the network-config read inside xml_dir.
Co-authored-by: Cursor <[email protected]>
* Drop CodeQL-appeasement basename sanitization from network config reads.
is_safe_path after join already rejects traversal, absolute, and Windows root-relative names; CodeQL py/path-injection is a false positive.
Co-authored-by: Cursor <[email protected]>
* Bound androguard ZIP member decompression
Use the configured per-file ZIP limit for apkinspector reads and cap
actual raw-DEFLATE output. Keep decompression-limit failures out of the
tampered-entry fallback so malicious compressed data cannot be treated
as stored bytes.
Co-authored-by: Cursor <[email protected]>
* Reject inactive SAML users before ACS group updates.
Existing accounts mapped from a valid IdP assertion should not have groups replaced or be passed to login() when is_active is False.
Co-authored-by: Cursor <[email protected]>
* Return the ACS error page for inactive users instead of raising Exception.
Co-authored-by: Cursor <[email protected]>
* Fix iOS plist-derived path traversal
Select and validate one contained IPA app bundle, reject unsafe plist
executable values, and guard icon and Mach-O inputs before access.
Harden equivalent source icon, plist, library, and dynamic icon paths.
Co-authored-by: Cursor <[email protected]>
* correct version
* fix CSRF in dynamic analysis actions
Co-authored-by: Ajin Abraham <[email protected]>
* document HTTPTools host header SSRF advisory
Co-authored-by: Ajin Abraham <[email protected]>
* prepare 4.5.3 dependency release
Co-authored-by: Ajin Abraham <[email protected]>
* support LIEF 0.17 Mach-O symbol types
Co-authored-by: Ajin Abraham <[email protected]>
* pin GitHub Actions to immutable commits
Co-authored-by: Ajin Abraham <[email protected]>
---------
Co-authored-by: Cursor <[email protected]>
* Harden path traversal checks for Windows root-relative escapes.
Reject POSIX/Windows absolute paths in is_path_traversal and require post-join containment at icon, network-config, and archive extraction sinks.
Co-authored-by: Cursor <[email protected]>
* Restrict network security config names to a basename.
CodeQL flagged the manifest-derived join; reduce the resource name first so path construction cannot escape xml_dir.
Co-authored-by: Cursor <[email protected]>
* Use os.path.basename for CodeQL-recognized path sanitization.
Path.name did not clear py/path-injection taint; basename plus existing containment checks keep the network-config read inside xml_dir.
Co-authored-by: Cursor <[email protected]>
* Drop CodeQL-appeasement basename sanitization from network config reads.
is_safe_path after join already rejects traversal, absolute, and Windows root-relative names; CodeQL py/path-injection is a false positive.
Co-authored-by: Cursor <[email protected]>
* Bound androguard ZIP member decompression
Use the configured per-file ZIP limit for apkinspector reads and cap
actual raw-DEFLATE output. Keep decompression-limit failures out of the
tampered-entry fallback so malicious compressed data cannot be treated
as stored bytes.
Co-authored-by: Cursor <[email protected]>
* Reject inactive SAML users before ACS group updates.
Existing accounts mapped from a valid IdP assertion should not have groups replaced or be passed to login() when is_active is False.
Co-authored-by: Cursor <[email protected]>
* Return the ACS error page for inactive users instead of raising Exception.
Co-authored-by: Cursor <[email protected]>
* Fix iOS plist-derived path traversal
Select and validate one contained IPA app bundle, reject unsafe plist
executable values, and guard icon and Mach-O inputs before access.
Harden equivalent source icon, plist, library, and dynamic icon paths.
Co-authored-by: Cursor <[email protected]>
* correct version
* fix CSRF in dynamic analysis actions
Co-authored-by: Ajin Abraham <[email protected]>
* document HTTPTools host header SSRF advisory
Co-authored-by: Ajin Abraham <[email protected]>
---------
Co-authored-by: Cursor <[email protected]>
* Harden path traversal checks for Windows root-relative escapes.
Reject POSIX/Windows absolute paths in is_path_traversal and require post-join containment at icon, network-config, and archive extraction sinks.
Co-authored-by: Cursor <[email protected]>
* Restrict network security config names to a basename.
CodeQL flagged the manifest-derived join; reduce the resource name first so path construction cannot escape xml_dir.
Co-authored-by: Cursor <[email protected]>
* Use os.path.basename for CodeQL-recognized path sanitization.
Path.name did not clear py/path-injection taint; basename plus existing containment checks keep the network-config read inside xml_dir.
Co-authored-by: Cursor <[email protected]>
* Drop CodeQL-appeasement basename sanitization from network config reads.
is_safe_path after join already rejects traversal, absolute, and Windows root-relative names; CodeQL py/path-injection is a false positive.
Co-authored-by: Cursor <[email protected]>
* Bound androguard ZIP member decompression
Use the configured per-file ZIP limit for apkinspector reads and cap
actual raw-DEFLATE output. Keep decompression-limit failures out of the
tampered-entry fallback so malicious compressed data cannot be treated
as stored bytes.
Co-authored-by: Cursor <[email protected]>
* Reject inactive SAML users before ACS group updates.
Existing accounts mapped from a valid IdP assertion should not have groups replaced or be passed to login() when is_active is False.
Co-authored-by: Cursor <[email protected]>
* Return the ACS error page for inactive users instead of raising Exception.
Co-authored-by: Cursor <[email protected]>
* Fix iOS plist-derived path traversal
Select and validate one contained IPA app bundle, reject unsafe plist
executable values, and guard icon and Mach-O inputs before access.
Harden equivalent source icon, plist, library, and dynamic icon paths.
Co-authored-by: Cursor <[email protected]>
* correct version
---------
Co-authored-by: Cursor <[email protected]>
* Harden path traversal checks for Windows root-relative escapes.
Reject POSIX/Windows absolute paths in is_path_traversal and require post-join containment at icon, network-config, and archive extraction sinks.
Co-authored-by: Cursor <[email protected]>
* Restrict network security config names to a basename.
CodeQL flagged the manifest-derived join; reduce the resource name first so path construction cannot escape xml_dir.
Co-authored-by: Cursor <[email protected]>
* Use os.path.basename for CodeQL-recognized path sanitization.
Path.name did not clear py/path-injection taint; basename plus existing containment checks keep the network-config read inside xml_dir.
Co-authored-by: Cursor <[email protected]>
* Drop CodeQL-appeasement basename sanitization from network config reads.
is_safe_path after join already rejects traversal, absolute, and Windows root-relative names; CodeQL py/path-injection is a false positive.
Co-authored-by: Cursor <[email protected]>
* Bound androguard ZIP member decompression
Use the configured per-file ZIP limit for apkinspector reads and cap
actual raw-DEFLATE output. Keep decompression-limit failures out of the
tampered-entry fallback so malicious compressed data cannot be treated
as stored bytes.
Co-authored-by: Cursor <[email protected]>
---------
Co-authored-by: Cursor <[email protected]>
* Harden path traversal checks for Windows root-relative escapes.
Reject POSIX/Windows absolute paths in is_path_traversal and require post-join containment at icon, network-config, and archive extraction sinks.
Co-authored-by: Cursor <[email protected]>
* Restrict network security config names to a basename.
CodeQL flagged the manifest-derived join; reduce the resource name first so path construction cannot escape xml_dir.
Co-authored-by: Cursor <[email protected]>
* Use os.path.basename for CodeQL-recognized path sanitization.
Path.name did not clear py/path-injection taint; basename plus existing containment checks keep the network-config read inside xml_dir.
Co-authored-by: Cursor <[email protected]>
* Drop CodeQL-appeasement basename sanitization from network config reads.
is_safe_path after join already rejects traversal, absolute, and Windows root-relative names; CodeQL py/path-injection is a false positive.
Co-authored-by: Cursor <[email protected]>
---------
Co-authored-by: Cursor <[email protected]>
gh pr comment fails with "not a git repository" because this workflow
intentionally skips checkout; GH_REPO and -R keep pull_request_target
from needing a clone of untrusted PR code.
Co-authored-by: Cursor <[email protected]>
Use pull_request_target only for posting fixed welcome text, with no
checkout or PR code execution, so fork PRs can be commented on without
exposing a stolen write token.
Co-authored-by: Cursor <[email protected]>
Security Fixes
[GHSA-8j49-mmcx-4mp5] Arbitrary File Read via Path Traversal in ZIP/APK Icon Extraction
The android:icon attribute from an APK manifest was interpolated into file paths without validation, allowing a crafted APK to read arbitrary files from the server. Fixed by adding is_path_traversal() and is_safe_path() guards in find_icon_path_zip. Dependency bump included.
[GHSA-3p54-567p-2wpr] CSRF Checks Not Enforced After Django Middleware Migration
The migration from the deprecated MIDDLEWARE_CLASSES to MIDDLEWARE omitted CsrfViewMiddleware, SecurityMiddleware, and XFrameOptionsMiddleware, leaving CSRF, HSTS, and clickjacking protections silently disabled. All three have been restored to the active MIDDLEWARE tuple. The now-dead MIDDLEWARE_CLASSES block has been removed to prevent future confusion.
[GHSA-x768-8642-mmq9] Zip Bomb Denial of Service via Per-File Size Limit Bypass
The per-file size check in ZIP extraction logged a warning on oversized members but was missing a continue, allowing files exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE to be extracted anyway as long as the aggregate limit was not reached. Fixed by adding the missing continue.
[GHSA-95px-34x5-p37h] SSRF Port Restriction Bypass in assetlinks_check
valid_host() was called with only the bare hostname, allowing android:port to be appended afterward without going through port validation, bypassing the HTTP/HTTPS-only restriction. Fixed with a two-layer approach: primary port allowlist check before URL assembly in get_browsable_activities, and a defence-in-depth re-check in _check_url.
Hardening
The hand-rolled safe_extract used os.path.abspath (symlink-blind) instead of os.path.realpath, creating a TOCTOU window where a symlink could redirect extraction outside the destination directory. Replaced with Python 3.12's tarfile.extractall(filter='data') (PEP 706), which rejects symlinks, hardlinks, absolute paths, and traversal members per-member before extraction. A robust realpath-based fallback is included for older Python versions.
Both download_app_data call sites in the iOS dynamic analyser now wrap app_container and tarfile with shlex.quote when building the SSH tar command, as defensive coding hygiene.
Refactoring
is_path_traversal, is_safe_path, clean_filename, cmd_injection_check, is_pipe_or_link, and is_attack_pattern were scattered across utils.py and shared.py. All have been moved to mobsf/MobSF/security.py as the single authoritative location for security primitives.
Developer Tooling
AGENTS.md / CLAUDE.md - AI agent guidelines
Added a coding-standards document for AI coding agents (Cursor, Claude, Codex) covering MobSF-specific secure-by-default patterns: path traversal guards, archive extraction safety, Django middleware active-tuple hygiene, split-validation anti-patterns (SSRF port bypass), guard completeness (continue/return/raise after every security check), and Django-specific security features (form validators, decorators, middleware). CLAUDE.md is a symlink to AGENTS.md.
- Added malware lookup using SHA2 with VirusTotal, Triage, Hybrid Analysis, and MetaDefender.
- Fixed permissions of extracted files to counter anti-analysis techniques.
- Resolved APK parsing errors in `androguard`.
- Handled exceptions in `string_on_binary`.
- Optimized APK ZIP analysis for improved performance.
- Fixed untar permission errors in dynamic analysis.
- Added bypass for SSL pinning in Boye's `AbstractVerifier`.
- Updated bypass for SSL pinning in Appmattus's `CertificateTransparencyInterceptor`.
- Introduced SSL pinning detector script.
- Improved Frida intent dumper script.
- Added Frida intent tracer script.
- Introduced timeouts for all HTTP calls.
- Added `django-q2`-based asynchronous scans for Android and iOS binaries and source code.
- Fixed bug in certificate analysis.
- Enabled asynchronous scans in Docker Compose setup.
- Performed QA for Android and iOS SAST modules.
- Added Frida script for `audit-webview`.
- Introduced Frida script for `trace-javascript-interface`.
- Upgraded `libsast` for improved file reading, multiprocessing, and multithreading.
- Fixed PNG crush issues on Darwin systems.
- Performed QA on the home screen UI.
- Updated `httptools` and `libsast` dependencies.
* Dockerfile: migrate from Ubuntu to Debian Bookworm
* Update and MachO and ELF Analysis
* Update docker compose with postgres
* JDK bump to 22.0.2
* Python bump to 3.12
* Bump jadx, apktool, vd2svg, bundletool
* Remove jadx from repo and download it dynamically during setup
* Install jadx during docker build
* Replace deprecated dependencies
* Bump httptools
* Postgres Support by default
* Bump LIEF to latest, reintroduce PIE checks for ELF
* Fixes#2430#2432#2395
* Bug Fixes
Authentication and Authorization (`Maintainer` , Viewer`) support in MobSF
* Basic User Management
* Bug Fixes in Runtime Executable Tampering
* Ratelimiting support for login endpoint
* Disable AuthZ/AuthN for REST API and also via ENV VAR `MOBSF_DISABLE_AUTHENTICATION=1`
* Bug Fix#2285
* Bug Fix Icon Analysis Nonetype
* Update SSRF Filter
* Dependency Bump
* Beta to Stable release from V4
* Runs with DEBUG=False
* New home screen UI
* [SECURITY] Fixes an LFI reported by @0x33c0unt - A crafted APK resource with icon name containing arbitrary path will get copied by MobSF as the icon file to the download directory which is available under `/download/` route. Fixed by https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/a58f8a8c0aa49e1581d97e19e8e2255ca96cd838
* Fixes#2324 , Bug in parsing DSA Public Key parameters for fingerprint calculation.
* Update dependencies
* iOS Dynamic Analysis Support with Corellium Jailbroken iOS devices
* Corellium API layer for complete device and project management
* Frida instrumentation (attach, spawn and inject) over SSH local port forward
* Shell access over SSH
* MobSF httptools proxy integration over SSH remote port forward
* Device File upload and download over SSH
* Frida scripts for core defense bypass, monitoring, and tracing
* Helper iOS Frida scripts for pentesting and malware analysis
* Screen cast with touch, swipe and text input support from web UI
* Dynamic Analysis device data dump and report Generation
* Android Certificate analysis, replaced oscrypto with cryptography for public key parsing
* Python minimum support is 3.10
* Bumped httptools to latest, fixes httptools repeat bug
* Added unzip to docker to fix a bug
* Migrate from setup.py to use poetry build and publish
* Tox QA
* Version is now configured only at pyproject.toml
* Added poetry build test
* Updated mobsf PyPI publishing workflow
* Update local DBs
dependabot[bot]