{"id":"CVE-2024-31215","aliases":["GHSA-wpff-wm84-x5cx","PYSEC-2026-1676"],"title":"Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check","summary":"Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","vendor":"mobsf","product":"mobsf","ecosystem":"pip","affected":["mobsf < 3.9.8"],"patched":["mobsf 3.9.8"],"published":"2024-04-04","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:11.534878261Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wpff-wm84-x5cx","references":[{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31215"},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373"},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716"},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF"}],"tags":["osv","pip"],"epss":0.0051,"epssPercentile":0.42505,"ingestedAt":"2026-07-08T18:25:53.859Z","slug":"CVE-2024-31215","body":"## Overview\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\nSSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When malicious app is uploaded to Static analyzer, it is possible to make internal requests.\n\nCredits:  Oleg Surnin (Positive Technologies).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nv3.9.8 and above\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nCode level patch\n\n### References\n_Are there any links users can visit to find out more?_\nhttps://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373\n\n## Affected packages\n\n- `mobsf < 3.9.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mobsf 3.9.8`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}