CVE-2025-24803: Mobile Security Framework (MobSF) XSS Flaw

CVE-2025-24803 Overview

CVE-2025-24803 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Mobile Security Framework (MobSF), an open-source automated pen-testing and malware analysis platform for Android, iOS, and Windows applications. The flaw exists in the iOS dynamic analysis workflow that integrates with Corellium. An attacker can craft a malicious Info.plist file containing special characters in the CFBundleIdentifier value. When MobSF renders the bundle identifier in dynamic_analysis.html, the value is not sanitized, allowing the attacker to break out of the HTML context and execute arbitrary JavaScript in the analyst's browser session.

Critical Impact
Authenticated attackers who submit a malicious iOS application for dynamic analysis can achieve stored XSS in the MobSF web interface, leading to session hijacking or actions performed on behalf of the analyst.

Affected Products

OpenSecurity Mobile Security Framework (MobSF) version 4.3.0
All MobSF releases prior to 4.3.1 that support Corellium-based iOS dynamic analysis
Deployments exposing the MobSF web UI to multiple analysts or tenants

Discovery Timeline

2025-02-05 - CVE-2025-24803 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-24803

Vulnerability Analysis

MobSF supports iOS dynamic analysis by orchestrating instances on the Corellium platform. During this workflow, MobSF extracts the CFBundleIdentifier value from the target application's Info.plist and displays it in the dynamic_analysis.html view. Apple's specification restricts bundle IDs to alphanumeric characters, hyphens, and periods, so MobSF treated the value as trusted. An attacker can manually edit Info.plist and inject HTML or JavaScript syntax into the bundle identifier field. Because the rendering template performed no output encoding, the injected payload executes in the browser context of any analyst who views the affected report or dynamic analysis page.

Root Cause

The root cause is missing input validation and output encoding for the bundle_id value flowing from Corellium into MobSF templates. The strict_package_check routine that enforces bundle ID format was invoked in some code paths but bypassed in others, including REST API entry points and URL routes that reached corellium_instance.py and report.py. Without a consistent check, arbitrary payloads reached the HTML template layer.

Attack Vector

Exploitation requires an attacker with permission to submit or trigger dynamic analysis of an iOS bundle. The attacker crafts an Info.plist containing a bundle identifier such as com.example.app"><script>...</script> and submits it through the MobSF interface or REST API. When a MobSF analyst opens the dynamic analysis report, the payload executes in their session, enabling cookie theft, CSRF against MobSF endpoints, or pivoting into internal networks hosting the scanner.

python

# Patch: enforce strict_package_check in corellium_instance.py
if failed:
    return send_response(failed, api)
if not strict_package_check(bundle_id):
    # Check bundle_id during call, as the check
    # is not done in REST API/URL repath.
    data['message'] = 'Invalid iOS Bundle id'
    return send_response(data, api)
ci = CorelliumInstanceAPI(instance_id)
# Source: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/05206e72cae35b311615a70e51e1a946955c5e83

python

# Patch: enforce strict_package_check in report.py
else:
    dev = ''
if not strict_package_check(bundle_id):
    # bundle_id is not validated in REST API.
    # Also bundleid is not strictly validated
    # in URL path.
    return print_n_send_error_response(
        request,
        'Invalid iOS Bundle id',
    )
# Source: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/05206e72cae35b311615a70e51e1a946955c5e83

Detection Methods for CVE-2025-24803

Indicators of Compromise

iOS application submissions where Info.plistCFBundleIdentifier contains characters outside [A-Za-z0-9.-], such as <, >, ", ', or /.
MobSF audit or web-server logs showing requests to /dynamic_analysis/ or Corellium REST endpoints with bundle ID parameters containing HTML or script tokens.
Unexpected outbound requests from analyst browsers immediately after opening a MobSF dynamic analysis report.

Detection Strategies

Inspect stored MobSF database records for bundle IDs that fail Apple's format rules; treat any non-conforming value as suspect.
Deploy Content Security Policy (CSP) violation reporting on the MobSF web interface to surface inline script execution attempts.
Correlate iOS scan submissions with subsequent anomalous session activity from the same analyst account.

Monitoring Recommendations

Monitor the MobSF server process for network connections to unknown hosts originating from analyst sessions.
Alert on modifications to files under the MobSF uploads and downloads directories that contain HTML markup in metadata fields.
Track version and patch level of MobSF instances across the environment to identify hosts still running 4.3.0 or earlier.

How to Mitigate CVE-2025-24803

Immediate Actions Required

Upgrade MobSF to version 4.3.1 or later, which enforces strict_package_check on both REST API and URL path entry points.
Restrict access to the MobSF web interface to trusted analysts and place it behind authenticated network controls.
Invalidate active MobSF sessions and rotate any API keys after upgrading if malicious iOS bundles were previously analyzed.

Patch Information

The fix is delivered in MobSF 4.3.1 via commit 05206e72cae35b311615a70e51e1a946955c5e83. The patch adds strict_package_check(bundle_id) calls in mobsf/DynamicAnalyzer/views/ios/corellium_instance.py and mobsf/DynamicAnalyzer/views/ios/report.py, rejecting any bundle identifier that does not comply with Apple's format. See the GitHub Security Advisory GHSA-cxqq-w3x5-7ph3 and the Apple Developer Documentation for CFBundleIdentifier for background.

Workarounds

No official workarounds exist per the vendor advisory; upgrading to 4.3.1 is the only supported remediation.
As a temporary compensating control, disable the Corellium-based iOS dynamic analysis feature until the upgrade is applied.
Limit iOS bundle submissions to trusted operators and manually validate Info.plistCFBundleIdentifier values before analysis.

bash

# Upgrade MobSF to the patched release
pip install --upgrade mobsf==4.3.1

# Or, for source deployments
git fetch --tags
git checkout v4.3.1
./setup.sh