MobSF Mobile-Security-Framework-MobSF up to 4.3.2 ZIP File Parser data amplification

Summaryinfo

A vulnerability has been found in MobSF Mobile-Security-Framework-MobSF up to 4.3.2 and classified as problematic. This affects an unknown function of the component ZIP File Parser. This manipulation causes data amplification. This vulnerability appears as CVE-2025-46730. The attack may be initiated remotely. There is no available exploit. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability classified as problematic was found in MobSF Mobile-Security-Framework-MobSF up to 4.3.2. Affected by this vulnerability is an unknown part of the component ZIP File Parser. The manipulation with an unknown input leads to a data amplification vulnerability. The CWE definition for the vulnerability is CWE-409. The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. As an impact it is known to affect availability. The summary by CVE is:

MobSF is a mobile application security testing tool used. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other security tools and web applications. Access to the MobSF web interface is often granted to internal security teams, audit teams, and external vendors. MobSF provides a feature that allows users to upload ZIP files for static analysis. Upon upload, these ZIP files are automatically extracted and stored within the MobSF directory. However, in versions up to and including 4.3.2, this functionality lacks a check on the total uncompressed size of the ZIP file, making it vulnerable to a ZIP of Death (zip bomb) attack. Due to the absence of safeguards against oversized extractions, an attacker can craft a specially prepared ZIP file that is small in compressed form but expands to a massive size upon extraction. Exploiting this, an attacker can exhaust the server's disk space, leading to a complete denial of service (DoS) not just for MobSF, but also for any other applications or websites hosted on the same server. This vulnerability can lead to complete server disruption in an organization which can affect other internal portals and tools too (which are hosted on the same server). If some organization has created their customized cloud based mobile security tool using MobSF core then an attacker can exploit this vulnerability to crash their servers. Commit 6987a946485a795f4fd38cebdb4860b368a1995d fixes this issue. As an additional mitigation, it is recommended to implement a safeguard that checks the total uncompressed size of any uploaded ZIP file before extraction. If the estimated uncompressed size exceeds a safe threshold (e.g., 100 MB), MobSF should reject the file and notify the user.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-46730 since 04/28/2025. The exploitation appears to be easy. The attack can be launched remotely. Additional levels of successful authentication are necessary for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Applying the patch 6987a946485a795f4fd38cebdb4860b368a1995d is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• MobSF

Name

• Mobile-Security-Framework-MobSF

Version

• 4.3.0
• 4.3.1
• 4.3.2

Website

• Product: https://github.com/MobSF/Mobile-Security-Framework-MobSF/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion