CVE-2022-41547 (Python, published 2022-10-18T15:15Z)
Description: value: Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MobSF/Mobile-Security-Framework-MobSF
Files changed:
APITester/views.py
DynamicAnalyzer/views.py
MalwareAnalyzer/malwaredb/malwaredomainlist
StaticAnalyzer/views.py
Commit message: Security: Fix for LFI found by thongngo


Vulnerable code:
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
        m=re.match('[0-9a-f]{32}',MD5)
        m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
        m=re.match('[0-9a-f]{32}',request.GET['md5'])
"2016/05/12_10:40","lojasrana.com:7080/ujh3jmd","186.202.183.138","pleskcl0243.hospedagemdesites.ws."
        m=re.match('[0-9a-f]{32}',MD5)
        m=re.match('[0-9a-f]{32}',request.GET['md5'])
        m=re.match('[0-9a-f]{32}',request.GET['md5'])
        m=re.match('[0-9a-f]{32}',request.POST['md5'])
        m=re.match('[0-9a-f]{32}',request.GET['md5'])
        m=re.match('[0-9a-f]{32}',MD5)
        m=re.match('[0-9a-f]{32}',request.GET['checksum'])
        m=re.match('[0-9a-f]{32}',request.GET['checksum'])
        m=re.match('[0-9a-f]{32}',MD5)

Fixed code:
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
        m=re.match('^[0-9a-f]{32}$',MD5)
        m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
"2016/05/12_10:40","lojasrana.com:7080/ujh3jmd","186.202.183.138","pleskcl0243.hospedagemdesites.ws.","Locky ransomware","-","27715","0","BR",
"2016/05/12_10:40","scrubs.dresscool.co/zcv3hhs","107.180.25.1","ip-107-180-25-1.ip.secureserver.net.","Locky ransomware","dresscool.co@domainsbyproxy.com","26496","0","US",
"2016/05/12_12:39","www.jobbainorge.nu/","195.74.38.95","cl-11.atm.binero.net.","pseudo darkleech on compromised site leads to Angler EK","-","41528","0","SE",
"2016/05/12_12:39","microencapsulation.readmyweather.com/satire/pairing/58798892_pkfpfGESM","69.162.126.172","172-126-162-69.static.reverse.lstn.net.","Angler EK","Registrar Abuse Contact support@domainbox.com","46475","0","US",
"2016/05/12_14:22","www.autoappassionati.it/","109.233.126.14","cpanel01.infinitynet.it.","pseudo darkleech on compromised site leads to Angler EK","-","48815","0","IT",
"2016/05/12_14:23","tannpastnevicher.themakershop.co.uk/mj/o/3557/","69.162.126.172","172-126-162-69.static.reverse.lstn.net.","Angler EK","Colyton Industrial Designs ltd / -","46475","0","US",
"2016/05/13_13:23","www.imageprecision.com/","188.121.41.53","n1nw8shg125.shr.prod.ams1.secureserver.net.","pseudo darkleech on compromised site leads to Angler EK","-","26496","0","NL",
"2016/05/13_13:23","arbeiderspartij.be-spry.co.uk/NTQBuUVxO/gXyyX/IobVvqD-pRXCfMd/","85.25.41.91","static-ip-85-25-41-91.inaddr.ip-pool.com.","Angler EK","H R Searle / -","8972","0","DE",
"2016/05/15_15:23","meuble-ligansadaequabat.thepinkskip.co.uk/hoteliers/6719/66/01/511758321.html","188.165.167.255","-","Angler EK","Brian Barr / -","16276","0","FR",
"2016/05/16_10:40","sign.cdrn70.xyz/hfziso4.html","93.190.140.154","-","gateway to Angler EK","-","49981","0","NL",
"2016/05/16_11:15","inclination.cdrn70.xyz/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","-","49981","0","NL",
"2016/05/16_11:51","no-id.eu/987t5t7g","83.137.194.81","server6.hosting2go.nl.","trojan","NOT DISCLOSED! / -","34233","0","NL",
"2016/05/16_11:55","press.centraljoias.com/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","Registrant flavio.dygo@gmail.com","49981","0","NL",
"2016/05/16_12:00","gutter.celebway.net/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","Registrar Abuse Contact abuse@bizcn.com","49981","0","NL",
"2016/05/16_12:35","charge.cenzorate-expertize.ro/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","-","49981","0","NL",
"2016/05/16_12:40","excitable.charmedmultimedia.eu/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","NOT DISCLOSED! / -","49981","0","NL",
"2016/05/16_18:05","sunlite.com.au/j76jn5nbv","27.124.119.225","server-69-r12.ipv4.au.syrahost.com.","Locky ransomware","Wayne Hughes / Visit whois.ausregistry.com.au for Web based WhoIs","38719","0","AU",
"2016/05/17_07:17","uwzorg.info/k76gf34g4g","89.105.197.30","mail.teurlings.biz.","Locky ransomware","MAM Teurlings / webmaster@teurlings.biz","24875","0","NL",
"2016/05/17_09:54","actinomorphous.excelwood.co.uk/euNsbCci/FAUk/Olvp/82749/SAitPlttYB-35817144-hgs.png","37.130.229.104","uk.server.","Angler EK","Decora Blind Systems / -","13213","0","GB",
"2016/05/17_10:32","www.gptecno.it/","178.255.186.250","www010.avanzati.it.","pseudo darkleech on compromised site leads to Angler EK","-","42425","0","IT",
"2016/05/17_10:32","armstrongcreekgeleedpotig.imber.me.uk/VDBGs/ftPRd/ZXyG-lBfzftj/","37.130.229.104","uk.server.","Angler EK","Nominet UK / -","13213","0","GB",
"2016/05/17_13:34","passagegoldtravel.com/678y8h","23.229.182.198","ip-23-229-182-198.ip.secureserver.net.","Locky ransomware","-","26496","0","US",
"2016/05/18_07:28","spreadware.com/09jhg54g","162.244.95.27","-","Locky ransomware","Registrar Abuse Contact abuse@namesilo.com","53667","0","US",
"2016/05/18_15:05","www.cafecalluna.nl/","193.239.186.142","sweb02.plinq.nl.","pseudo darkleech on compromised site leads to Angler EK","-","35224","0","NL",
"2016/05/18_15:05","brunowtrahoque-miagola.unishadeverticalsystem.com/1331481-positivity-misdiagnosis-refrigerants-slim-twinkles-array.png","63.143.54.198","198-54-143-63.static.reverse.lstn.
        m=re.match('^[0-9a-f]{32}$',MD5)
        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
        m=re.match('^[0-9a-f]{32}$',request.POST['md5'])
        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
        m=re.match('^[0-9a-f]{32}$',MD5)
        m=re.match('^[0-9a-f]{32}$',request.GET['checksum'])
        m=re.match('^[0-9a-f]{32}$',request.GET['checksum'])
        m=re.match('^[0-9a-f]{32}$',MD5)