CVE-2025-24804: Mobile Security Framework (MobSF) DOS Vulnerability

CVE-2025-24804 Overview

Mobile Security Framework (MobSF) contains an input validation flaw in its iOS application analysis workflow. An authenticated attacker can upload an iOS application whose Info.plist file contains a CFBundleIdentifier value with special characters outside the alphanumeric, hyphen, and period set that Apple documents. When MobSF parses the malformed bundle identifier, it raises an unhandled exception and returns HTTP 500 errors. The affected views remain broken until an operator manually removes the malicious application from the MobSF instance. Maintainers addressed the issue in version 4.3.1, and no configuration workaround is available for earlier releases.

Critical Impact
Persistent denial of service against MobSF iOS analysis views through a crafted CFBundleIdentifier, requiring manual application removal to restore functionality.

Affected Products

OpenSecurity Mobile Security Framework (MobSF) versions prior to 4.3.1
MobSF Dynamic Analyzer iOS module (mobsf/DynamicAnalyzer/views/ios/)
MobSF REST API and URL routes that accept a bundle_id parameter without strict validation

Discovery Timeline

2025-02-05 - CVE-2025-24804 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24804

Vulnerability Analysis

MobSF ingests iOS application metadata from the Info.plist file bundled inside an IPA archive. Apple's documentation restricts CFBundleIdentifier values to A–Z, a–z, 0–9, hyphens, and periods. MobSF trusted this convention rather than enforcing it during parsing.

An attacker with the ability to upload applications can manually edit Info.plist and insert characters such as slashes, quotes, or shell metacharacters into the CFBundleIdentifier key. When MobSF reads the value into downstream routing, template rendering, or file path logic, the parsing code throws an exception. The framework returns HTTP 500 responses on any view that touches the crafted record.

The condition is persistent. Because the malicious entry is stored in the MobSF database, restarting the service does not resolve the failure. An operator must remove the offending application record manually. This maps to [CWE-1287: Improper Validation of Specified Type of Input].

Root Cause

MobSF lacked a strict server-side check on bundle_id values received through the REST API and URL paths. Validation was only applied at certain UI boundaries, leaving inner iOS Dynamic Analyzer views exposed to malformed identifiers.

Attack Vector

Exploitation requires authenticated access to a MobSF instance with permission to submit or reference iOS applications. The attacker crafts an IPA whose Info.plist defines a CFBundleIdentifier containing characters outside the Apple-permitted set, then triggers any view that resolves the bundle. The response chain breaks and remains broken until manual cleanup.

python

# Patch: mobsf/DynamicAnalyzer/views/ios/corellium_instance.py
         if failed:
             return send_response(failed, api)
         if not strict_package_check(bundle_id):
+            # Check bundle_id during call, as the check
+            # is not done in REST API/URL repath.
             data['message'] = 'Invalid iOS Bundle id'
             return send_response(data, api)
         ci = CorelliumInstanceAPI(instance_id)

# Patch: mobsf/DynamicAnalyzer/views/ios/report.py
         else:
             dev = ''
         if not strict_package_check(bundle_id):
-            # We need this check since bundleid
-            # is not validated in REST API
+            # bundle_id is not validated in REST API.
+            # Also bundleid is not strictly validated
+            # in URL path.
             return print_n_send_error_response(
                 request,
                 'Invalid iOS Bundle id',

Source: GitHub MobSF Commit 05206e72. The fix adds strict_package_check(bundle_id) calls to iOS Dynamic Analyzer entry points, rejecting non-conforming identifiers before further processing.

Detection Methods for CVE-2025-24804

Indicators of Compromise

IPA uploads containing an Info.plist where CFBundleIdentifier includes characters outside [A-Za-z0-9.-]
MobSF application records whose stored bundle_id field fails a strict regex check
Recurring HTTP 500 responses from /dynamic_analyzer/ios/ routes tied to a specific application ID

Detection Strategies

Inspect MobSF application storage and flag any bundle_id value that does not match ^[A-Za-z0-9.-]+$.
Review web server access logs for repeated 500 responses on iOS analyzer endpoints originating from the same authenticated user.
Correlate IPA upload events with subsequent unhandled exceptions in the MobSF application log.

Monitoring Recommendations

Enable structured logging on the MobSF Django backend and alert on unhandled exceptions in DynamicAnalyzer/views/ios/.
Track authenticated upload activity and compare against the list of users authorized to submit iOS samples.
Monitor HTTP 5xx rates per endpoint to detect the persistent failure state introduced by a malformed record.

How to Mitigate CVE-2025-24804

Immediate Actions Required

Upgrade MobSF to version 4.3.1 or later on all analyst workstations and shared instances.
Audit stored applications and delete any record whose bundle_id contains characters outside the Apple-permitted set.
Restrict MobSF access to trusted analysts and require authentication on every deployment, including internal ones.

Patch Information

The fix is delivered in MobSF 4.3.1. Commit 05206e72cae35b311615a70e51e1a946955c5e83 adds strict_package_check(bundle_id) guards inside mobsf/DynamicAnalyzer/views/ios/corellium_instance.py and mobsf/DynamicAnalyzer/views/ios/report.py. Details are published in GitHub Security Advisory GHSA-jrm8-xgf3-fwqr.

Workarounds

No vendor-supported workaround exists for versions prior to 4.3.1; upgrading is the only remediation.
Limit iOS application uploads to a small set of vetted operators until the patch is applied.
If a 500 error state is triggered, remove the offending application record from the MobSF database and restart the service.

bash

# Upgrade MobSF to the patched release
pip install --upgrade mobsf==4.3.1

# Or, for source installs
git fetch --tags
git checkout v4.3.1
./setup.sh

# Verify the installed version
mobsf --version