Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mobsf | pip | < 4.5.1 | 4.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Cross-Site Request Forgery (CSRF) caused by the omission of Django's CsrfViewMiddleware from the active MIDDLEWARE configuration in mobsf/MobSF/settings.py. This middleware is essential for protecting against CSRF attacks on state-changing requests (typically POST, PUT, DELETE). Its absence meant that any authenticated POST endpoint in the application was left unprotected.
The analysis started by examining the provided patch commit, 62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf, which clearly shows the addition of django.middleware.csrf.CsrfViewMiddleware to the MIDDLEWARE list. This confirms the root cause of the vulnerability.
Next, using the list of affected endpoints from the vulnerability description (/delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, /delete_user/), I inspected the project's URL configuration file, mobsf/MobSF/urls.py, to map these URLs to their corresponding view functions in the Django application. This process identified the specific functions that would be executed during a CSRF attack. These functions, while not containing the vulnerability themselves, are the entry points that become vulnerable due to the global configuration flaw.
delete_scanmobsf/MobSF/views/home.py
Upload.postmobsf/MobSF/views/home.py
download_apkmobsf/MobSF/views/home.py
change_passwordmobsf/MobSF/views/authentication.py
create_usermobsf/MobSF/views/authorization.py
delete_usermobsf/MobSF/views/authorization.py