https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 23:31:35 +0000 https://vulnerability.circl.lu/vuln/cve-2024-53999 <p><strong>Affected:</strong> MobSF Mobile-Security-Framework-MobSF, mobsf mobile_security_framework</p> <p>Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the &#34;Diff or Compare&#34; functionality, they are affected by a Stored Cross-Site Scripting vulnerability. This vulnerability is fixed in 4.2.9.</p> <p><strong>Affected:</strong> MobSF Mobile-Security-Framework-MobSF, mobsf mobile_security_framework</p> <p>Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the &#34;Diff or Compare&#34; functionality, they are affected by a Stored Cross-Site Scripting vulnerability. This vulnerability is fixed in 4.2.9.</p> https://vulnerability.circl.lu/vuln/cve-2024-53999 https://vulnerability.circl.lu/vuln/ghsa-5jc6-h9w7-jm3p <p><strong>Affected:</strong> PyPI: mobsf</p> <p>### Summary The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the &#34;Diff or Compare&#34; functionality, they are affected by a Stored Cross-Site Scripting vulnerability.</p> <p>### Details I found a Stored Cross-Site Scripting vulnerability in the &#34;Diff or Compare&#34; functionality. This issue occurs because the upload functionality allows users to upload files with special characters such as &lt;, &gt;, /, and &#34; in the filename. This vulnerability can be mitigated by restricting file uploads to filenames containing only whitelisted characters, such as A-Z, 0-9, and specific special characters permitted by business requirements, like - or _ .</p> <p>### PoC _Complete instructions, including specific configuration details, to reproduce the vulnerability._ 1. On MobSF version 4.2.8, I clicked on &#34;Unload &amp; Analyze&#34; button. </p> <p>2. I uploaded zip file as a name `test.zip`. </p> <p>3. I used an intercepting proxy tool while uploading a file and changed the value of the filename parameter from `test.zip` to `&lt;image src onerror=prompt(document.domain)&gt;test.zip`. This means I uploaded a file and set its name to a script value. As a result, the server allowed the file to be uploaded successfully. </p> <p>2. I uploaded zip file as a name `test.zip`. </p> <p>3. I used an intercepting proxy tool while uploading a file and changed the value of the filename parameter from `test.zip` to `&lt;image src onerror=prompt(document.domain)&gt;test.zip`. This means I uploaded a file and set its name to a script value. As a result, the server allowed the file to be uploaded successfully. ![2](https://gith…</p> https://vulnerability.circl.lu/vuln/ghsa-5jc6-h9w7-jm3p