Wednesday, December 4, 2024
HomeCVE/vulnerabilityMobSF XSS Vulnerability Let Attackers Inject Malicious Scripts

MobSF XSS Vulnerability Let Attackers Inject Malicious Scripts

Published on

SIEM as a Service

A critical vulnerability has been identified in the Mobile Security Framework (MobSF) that allows attackers to inject malicious scripts into the system.

This vulnerability, CVE-2024-53999 is a Stored Cross-Site Scripting (XSS) flaw found in the “Diff or Compare” functionality, which occurs due to improper handling of file uploads with script-laden filenames.

Details of the Vulnerability

The vulnerability was discovered in MobSF version 4.2.8 in Github, where the application allows users to upload files with scripts embedded in the filename parameter.

- Advertisement - SIEM as a Service

Specifically, the issue arises because the upload feature permits filenames containing special characters such as <, >, /, and “. Such oversights make it possible for a malicious user to upload a script file and set its name to a script value, which the server accepts without validation.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar

This oversight can potentially be mitigated by implementing stricter filename validation. By restricting file uploads to filenames containing only whitelisted characters—such as A-Z, 0-9, and specific special characters like – or _ that are permitted by business requirements—this risk could be significantly reduced.

Proof of Concept (PoC)

To illustrate this vulnerability, a proof of concept was created with the following steps:

  1. Use of Intercepting Proxy: On MobSF version 4.2.8, the “Unload & Analyze” button was clicked, and a file named test.zip was uploaded. During this process, an intercepting proxy tool was used to change the value of the filename parameter from test.zip to <image src onerror=prompt(document.domain)>test.zip.
Use of Intercepting Proxy
Use of Intercepting Proxy
  1. Successful Upload: The altered filename was accepted by the server, and the file was uploaded successfully.
altered filename
altered filename
  1. Script Execution: Upon accessing /recent_scans/, the file <image src onerror=prompt(document.domain)>test.zip appeared in the list. Clicking on the “Differ or Compare” button and selecting this file led to the execution of JavaScript embedded in the filename within the web browser.
Script Execution
Script Execution

The impact of this vulnerability is significant. By allowing a malicious script to be stored in the system via the filename parameter, attackers can access sensitive information belonging to other users or administrators during the comparison process.

impact of the vulnerability
impact of the vulnerability

This flaw not only compromises data confidentiality but also poses a persistent threat as the injected script remains stored in the system.

The MobSF team is urged to implement immediate fixes by validating and sanitizing filename inputs to prevent such vulnerabilities.

In the meantime, users are advised to exercise caution and apply any patches or updates released by the MobSF developers to mitigate these security risks.

Analyse Advanced Malware & Phishing Analysis With ANY.RUN Black Friday Deals : Get up to 3 Free Licenses.

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Deloitte UK Hacked – Brain Cipher Group Claim to Have Stolen 1 TB of Data

Brain Cipher has claimed to have breached Deloitte UK and exfiltrated over 1 terabyte...

Cloudflare Developer Domains Abused For Cyber Attacks

Cloudflare Pages, a popular web deployment platform, is exploited by threat actors to host...

Hackers Exploit Docker Remote API Servers To Inject Gafgyt Malware

Attackers are exploiting publicly exposed Docker Remote API servers to deploy Gafgyt malware by...

Weaponized Word Documents Attacking Windows Users to Deliver NetSupport & BurnsRAT

The threat actors distributed malicious JS scripts disguised as legitimate business documents, primarily in...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

Deloitte UK Hacked – Brain Cipher Group Claim to Have Stolen 1 TB of Data

Brain Cipher has claimed to have breached Deloitte UK and exfiltrated over 1 terabyte...

Cloudflare Developer Domains Abused For Cyber Attacks

Cloudflare Pages, a popular web deployment platform, is exploited by threat actors to host...

Hackers Exploit Docker Remote API Servers To Inject Gafgyt Malware

Attackers are exploiting publicly exposed Docker Remote API servers to deploy Gafgyt malware by...