mirror of
https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
synced 2026-10-11 22:50:09 +00:00
Ajin Abraham
62563ca429
Security Fixes [GHSA-8j49-mmcx-4mp5] Arbitrary File Read via Path Traversal in ZIP/APK Icon Extraction The android:icon attribute from an APK manifest was interpolated into file paths without validation, allowing a crafted APK to read arbitrary files from the server. Fixed by adding is_path_traversal() and is_safe_path() guards in find_icon_path_zip. Dependency bump included. [GHSA-3p54-567p-2wpr] CSRF Checks Not Enforced After Django Middleware Migration The migration from the deprecated MIDDLEWARE_CLASSES to MIDDLEWARE omitted CsrfViewMiddleware, SecurityMiddleware, and XFrameOptionsMiddleware, leaving CSRF, HSTS, and clickjacking protections silently disabled. All three have been restored to the active MIDDLEWARE tuple. The now-dead MIDDLEWARE_CLASSES block has been removed to prevent future confusion. [GHSA-x768-8642-mmq9] Zip Bomb Denial of Service via Per-File Size Limit Bypass The per-file size check in ZIP extraction logged a warning on oversized members but was missing a continue, allowing files exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE to be extracted anyway as long as the aggregate limit was not reached. Fixed by adding the missing continue. [GHSA-95px-34x5-p37h] SSRF Port Restriction Bypass in assetlinks_check valid_host() was called with only the bare hostname, allowing android:port to be appended afterward without going through port validation, bypassing the HTTP/HTTPS-only restriction. Fixed with a two-layer approach: primary port allowlist check before URL assembly in get_browsable_activities, and a defence-in-depth re-check in _check_url. Hardening The hand-rolled safe_extract used os.path.abspath (symlink-blind) instead of os.path.realpath, creating a TOCTOU window where a symlink could redirect extraction outside the destination directory. Replaced with Python 3.12's tarfile.extractall(filter='data') (PEP 706), which rejects symlinks, hardlinks, absolute paths, and traversal members per-member before extraction. A robust realpath-based fallback is included for older Python versions. Both download_app_data call sites in the iOS dynamic analyser now wrap app_container and tarfile with shlex.quote when building the SSH tar command, as defensive coding hygiene. Refactoring is_path_traversal, is_safe_path, clean_filename, cmd_injection_check, is_pipe_or_link, and is_attack_pattern were scattered across utils.py and shared.py. All have been moved to mobsf/MobSF/security.py as the single authoritative location for security primitives. Developer Tooling AGENTS.md / CLAUDE.md - AI agent guidelines Added a coding-standards document for AI coding agents (Cursor, Claude, Codex) covering MobSF-specific secure-by-default patterns: path traversal guards, archive extraction safety, Django middleware active-tuple hygiene, split-validation anti-patterns (SSRF port bypass), guard completeness (continue/return/raise after every security check), and Django-specific security features (form validators, decorators, middleware). CLAUDE.md is a symlink to AGENTS.md.
69 lines
2.1 KiB
TOML
69 lines
2.1 KiB
TOML
[tool.poetry]
|
|
name = "mobsf"
|
|
version = "4.5.1"
|
|
description = "Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis."
|
|
keywords = ["mobsf", "mobile security framework", "mobile security", "security tool", "static analysis", "dynamic analysis", "malware analysis"]
|
|
authors = ["Ajin Abraham <[email protected]>"]
|
|
license = "GPL-3.0-only"
|
|
readme = "README.md"
|
|
repository = "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
|
|
documentation = "https://mobsf.github.io/docs/"
|
|
packages = [{ include = "mobsf", format = ["sdist", "wheel"]}]
|
|
classifiers = [
|
|
"Development Status :: 5 - Production/Stable",
|
|
"Intended Audience :: Developers",
|
|
"Topic :: Security",
|
|
"Topic :: Software Development :: Quality Assurance",
|
|
]
|
|
|
|
[tool.poetry.urls]
|
|
"Bug Tracker" = "https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues"
|
|
|
|
[tool.poetry.scripts]
|
|
mobsf = "mobsf.__main__:main"
|
|
|
|
[tool.poetry.dependencies]
|
|
python = "^3.12"
|
|
django = ">=3.1.5"
|
|
rsa = ">=4.7"
|
|
requests = ">=2.25.1"
|
|
bs4 = ">=0.0.1"
|
|
colorlog = ">=4.7.2"
|
|
macholib = ">=1.14"
|
|
whitenoise = ">=6.8.2"
|
|
waitress = {version = ">=3.0.1", markers = "sys_platform == 'win32'"}
|
|
gunicorn = {version = ">=20.0.4", markers = "sys_platform != 'win32'"}
|
|
psutil = ">=5.8.0"
|
|
shelljob = ">=0.6.2"
|
|
asn1crypto = ">=1.4.0"
|
|
distro = ">=1.5.0"
|
|
ip2location = "^8.10.4"
|
|
pdfkit = ">=0.6.1"
|
|
google-play-scraper = ">=0.1.2"
|
|
apkid = "^3.0.0"
|
|
frida = ">=17.0.0"
|
|
frida-tools = "^14.3.0"
|
|
tldextract = ">=5.1.3"
|
|
openstep-parser = ">=2.0.1"
|
|
svgutils = ">=0.3.4"
|
|
arpy = ">=2.3.0"
|
|
apksigtool = "^0.1.0"
|
|
tzdata = "^2023.3"
|
|
http-tools = ">=6.0.0"
|
|
libsast = "^3.1.6"
|
|
paramiko = "^3.3.1"
|
|
six = ">=1.16.0"
|
|
python3-saml = "^1.16.0"
|
|
psycopg2-binary = "^2.9.10"
|
|
lief = "^0.16.6"
|
|
packaging = ">=24.2"
|
|
django-ratelimit = "^4.1.0"
|
|
django-q2 = "^1.7.4"
|
|
defusedxml = "^0.7.1"
|
|
bleach = "^6.2.0"
|
|
bcrypt = "4.0.1" # Pinned to avoid warnings with mitmproxy 12
|
|
|
|
[build-system]
|
|
requires = ["poetry-core"]
|
|
build-backend = "poetry.core.masonry.api"
|