CVE-2024-29190: SSRF Vulnerability on assetlinks_check(act_name, well_knowns)
(updated )
While examining the “App Link assetlinks.json file could not be found” vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the “/.well-known/assetlinks.json” endpoint for all hosts written with “android:host”. In the AndroidManifest.xml file.
Since MobSF does not perform any input validation when extracting the hostnames in “android:host”, requests can also be sent to local hostnames. This may cause SSRF vulnerability.
References
- drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link
- github.com/MobSF/Mobile-Security-Framework-MobSF
- github.com/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77
- github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3
- github.com/MobSF/mobsfscan/commit/61fd40b477bbf9d204eb8c5a83a86c396d839798
- github.com/MobSF/mobsfscan/commit/cd01b71770a6e56c1c71b0e5f454e7b6c9c64ef4
- github.com/advisories/GHSA-wfgj-wrgh-h3r3
- github.com/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2024-257.yaml
- nvd.nist.gov/vuln/detail/CVE-2024-29190
Code Behaviors & Features
Detect and mitigate CVE-2024-29190 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →