Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mobsf | pip | < 4.5.1 | 4.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) in MobSF's Android assetlinks checker. The root cause is a flaw in how the application validates URLs for deep linking, specified in the AndroidManifest.xml file. The get_browsable_activities function extracts the android:host and android:port values. While it validates the host using the valid_host() function, it fails to validate the port. The unvalidated port is then concatenated with the validated host to form a URL. This URL is then passed to the _check_url function, which makes an outbound HTTP request. An attacker can provide a crafted APK with a benign host but a malicious port (e.g., for an internal service). The host validation passes, but the subsequent request is made to the internal service on the specified port. The patch addresses this by adding explicit port validation in both get_browsable_activities before URL construction and as a defense-in-depth measure in _check_url before the request is made, ensuring only ports 80 and 443 are allowed.
