Cyber Posture

CVE-2025-31116

MediumPublic PoC

Published: 31 March 2025

Published
31 March 2025
Modified
12 June 2025
KEV Added
Patch
CVSS Score 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L
EPSS Score 0.0031 54.1th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-31116 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, affecting the Mobile Security Framework (MobSF), an open-source tool for pen-testing, malware analysis, and security assessment of mobile applications via static and dynamic analysis. The flaw exists in the mitigation for the prior CVE-2024-29190 within the valid_host() function, which uses socket.gethostbyname() and is susceptible to SSRF abuse through DNS rebinding techniques. It carries a CVSS v3.1 base score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L) and was published on 2025-03-31. The vulnerability is fixed in MobSF version 4.3.2.

Exploitation is feasible over the network by attackers with high privileges, such as authenticated administrators, though it demands high attack complexity due to the DNS rebinding requirements and involves no user interaction. Successful attacks change scope and enable limited confidentiality impacts, such as unauthorized access to internal network resources, along with limited availability disruptions, but no integrity impacts.

The official GitHub security advisory (GHSA-fcfq-m8p6-gw56) and the patching commit (4b8bab5a9858c69fe13be4631b82d82186e0d3bd) confirm the fix in MobSF 4.3.2, recommending immediate upgrades for deployed instances to prevent SSRF exploitation.

Details

CWE(s)
CWE-918

Affected Products

opensecurity
mobile security framework
≤ 4.3.2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SSRF vulnerability in the MobSF web application (public-facing with network attack vector) directly enables exploitation of a public-facing application to access internal resources via DNS rebinding.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References