Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Date: 2024-12
Affected: pip/mobsf
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-53999
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N)

### Summary The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the "Diff or Compare" functionality, they are affected by a Stored Cross-Site Scripting vulnerability. ### Details I found a Stored Cross-Site Scripting vulnerability in the "Diff or Compare" functionality. This issue occurs because the upload functionality allows users to upload files with special characters such as <, >, /, and " in the filename. This vulnerability can be mitigated by restricting file uploads to filenames containing only whitelisted characters, such as A-Z, 0-9, and specific special characters permitted by business requirements, like - or _ . ### PoC _Complete instructions, including specific configuration details, to reproduce the vulnerability._ 1. On MobSF version 4.2.8, I clicked on "Unload & Analyze" button. ![0](https://github.com/user-attachments/assets/489013fe-cf21-4839-bd39-35eebad01a3a) 2. I uploaded zip file as a name `test.zip`. ![1](https://github.com/user-attachments/assets/c26a18ec-c276-43d5-97df-fb189b8d5a6a) 3. I used an intercepting proxy tool while uploading a file and changed the value of the filename parameter from `test.zip` to `<image src onerror=prompt(document.domain)>test.zip`. This means I uploaded a file and set its name to a script value. As a result, the server allowed the file to be uploaded successfully. ![2](https://githu


Mitigations:

Architectural layers (MAESTRO):