CVE-2024-31215

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.

• CWE-918

• https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716Patch
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373Issue Tracking, Patch
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cxVendor Advisory
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716Patch
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373Issue Tracking, Patch
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cxVendor Advisory

Published

Apr 4, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3121A remote code execution vulnerability exists in the create_c…3.3
• CVE-2024-31210WordPress is an open publishing platform for the Web. It's p…8.8
• CVE-2024-31211WordPress is an open publishing platform for the Web. Unseri…9.8
• CVE-2024-31212InstantCMS is a free and open source content management syst…7.2
• CVE-2024-31213InstantCMS is a free and open source content management syst…5.4
• CVE-2024-31214Traccar is an open source GPS tracking system. Traccar versi…9.6
• CVE-2024-31216The source-controller is a Kubernetes operator, specialised …5.1
• CVE-2024-31217Strapi is an open-source content management system. Prior to…6.5
• CVE-2024-31218Webhood is a self-hosted URL scanner used analyzing phishing…9.8
• CVE-2024-31219Discourse-reactions is a plugin that allows user to add thei…4.3
• CVE-2024-3122CHANGING Mobile One Time Password does not properly filter p…4.9
• CVE-2024-31220Sunshine is a self-hosted game stream host for Moonlight. St…7.3