CVE-2025-24805: MobSF Auth Bypass Vulnerability

CVE-2025-24805 Overview

CVE-2025-24805 is an Improper Privilege Management vulnerability affecting Mobile Security Framework (MobSF), an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis, and security assessment framework. The vulnerability allows a local user with minimal privileges to make use of an access token for materials and scopes which it should not be accepted, effectively bypassing authorization controls.

Critical Impact

A low-privileged user can exploit insufficient input validation in REST API endpoints to access unauthorized resources, potentially exposing sensitive mobile application analysis data and security assessment results.

Affected Products

• OpenSecurity Mobile Security Framework (MobSF) versions prior to 4.3.1
• MobSF installations with exposed REST API endpoints
• MobSF deployments utilizing iOS Corellium dynamic analysis features

Discovery Timeline

• February 5, 2025 - CVE-2025-24805 published to NVD
• May 23, 2025 - Last updated in NVD database

Technical Details for CVE-2025-24805

Vulnerability Analysis

This vulnerability stems from CWE-269 (Improper Privilege Management), where the MobSF application fails to properly validate bundle identifiers when processing requests through REST API endpoints and URL paths. The flaw exists in the iOS dynamic analysis components, specifically within the Corellium instance handling and report generation modules.

The core issue is that bundle ID validation was not being performed consistently across all entry points. While some validation existed, the REST API and URL path handlers did not strictly enforce bundle ID validation, allowing users to access resources belonging to different scopes or sessions than they were authorized for.

Root Cause

The root cause of CVE-2025-24805 lies in inconsistent input validation across different code paths. The strict_package_check() function, which validates iOS Bundle IDs, was not being invoked during REST API calls and URL path processing. This oversight allowed attackers to craft requests with manipulated bundle identifiers that bypassed authorization checks, granting access to analysis results and resources they should not have permission to view or modify.

Attack Vector

The attack is network-accessible and requires low privileges with some user interaction. An authenticated user with minimal access can exploit the vulnerability by:

1. Obtaining a valid access token through normal authentication
2. Crafting requests to REST API endpoints with manipulated bundle identifiers
3. Accessing iOS analysis reports, dynamic analysis results, or Corellium instance data belonging to other users or sessions

The vulnerability requires network access to the MobSF instance and valid authentication credentials, but the privilege escalation allows access to unauthorized scopes.

# Security patch in mobsf/DynamicAnalyzer/views/ios/corellium_instance.py
# This patch ensures bundle_id validation is performed during API calls
         if failed:
             return send_response(failed, api)
         if not strict_package_check(bundle_id):
+            # Check bundle_id during call, as the check
+            # is not done in REST API/URL repath.
             data['message'] = 'Invalid iOS Bundle id'
             return send_response(data, api)
         ci = CorelliumInstanceAPI(instance_id)

Source: GitHub Commit

# Security patch in mobsf/DynamicAnalyzer/views/ios/report.py
# Enhanced validation with clearer documentation of the security boundary
         else:
             dev = ''
         if not strict_package_check(bundle_id):
-            # We need this check since bundleid
-            # is not validated in REST API
+            # bundle_id is not validated in REST API.
+            # Also bundleid is not strictly validated
+            # in URL path.
             return print_n_send_error_response(
                 request,
                 'Invalid iOS Bundle id',

Source: GitHub Commit

Detection Methods for CVE-2025-24805

Indicators of Compromise

• Unusual access patterns to iOS analysis reports from low-privileged accounts
• API requests containing bundle IDs that don't match the user's authorized scope
• Multiple requests to /api/v1/ endpoints with varying bundle identifiers from the same session
• Access attempts to Corellium instance data outside normal usage patterns

Detection Strategies

• Monitor REST API logs for requests with bundle identifiers that don't match the authenticated user's session
• Implement anomaly detection for users accessing analysis reports they did not initiate
• Review authentication logs for accounts accessing resources across multiple unrelated bundle IDs
• Set up alerts for rapid sequential API calls with different bundle identifiers

Monitoring Recommendations

• Enable detailed audit logging on MobSF REST API endpoints
• Deploy network monitoring to track API traffic patterns to MobSF instances
• Implement session tracking to correlate user authentication with accessed resources
• Create dashboards to visualize access patterns to iOS dynamic analysis features

How to Mitigate CVE-2025-24805

Immediate Actions Required

• Upgrade MobSF to version 4.3.1 or later immediately
• Review audit logs for any unauthorized access to iOS analysis reports prior to patching
• Validate user session integrity and revoke any suspicious access tokens
• Restrict network access to MobSF instances to trusted IP ranges where possible

Patch Information

The vulnerability has been addressed in MobSF version 4.3.1. The fix implements proper bundle ID validation at all entry points, including REST API calls and URL path handlers. The security patch was committed with hash 05206e72cae35b311615a70e51e1a946955c5e83 and is available through the official GitHub repository. All users are strongly advised to upgrade to the patched version. For additional details, refer to the GitHub Security Advisory GHSA-79f6-p65j-3m2m.

Workarounds

• No official workarounds are available for this vulnerability; upgrading to version 4.3.1 is the only remediation
• As a temporary measure, restrict MobSF access to trusted users only pending the upgrade
• Consider disabling iOS dynamic analysis features if they are not immediately required
• Implement additional network-level access controls to limit exposure while preparing for the upgrade

# Upgrade MobSF to patched version
# Option 1: Using pip
pip install --upgrade mobsf

# Option 2: Using Docker (recommended)
docker pull opensecurity/mobile-security-framework-mobsf:v4.3.1
docker stop mobsf-container
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:v4.3.1

# Option 3: From source
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
cd Mobile-Security-Framework-MobSF
git checkout v4.3.1
./setup.sh