CVE-2025-24805Medium· 6.5▾ SunlitMobSF Local Privilege Escalation
MobSF Local Privilege Escalation
▾ Sunlit zone — Low / medium · no exploitation signal
Depth score36/ 100 · Low
impact 35.8 · likelihood 0.1 · exploitation 0
Proof of concept
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Published
Feb 5, 2025
Updated
Jul 7, 2026
CVSS
6.5
Vendor
mobsf
Product
mobsf
CWE
—
Depth score
36 · Low
EPSS
0.36% · p30
Platforms
—
Source
OSV
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS history
Exploit-prediction probability, daily snapshots since Jul 8.
Timeline
Disclosure to exploitation, from the record and what we observed since indexing it.
- Published
Disclosed via OSV
- Record revised
Last analysed / modified upstream
- EPSS first tracked
0.3%
- EPSS peak
0.3% → 0.4%
Affected
- mobsf < 4.3.1
Patched in
- mobsf 4.3.1
Full technical detail▾
Overview
Product: Mobile Security Framework (MobSF)
Version: 4.3.0
CWE-ID: CWE-269: Improper Privilege Management
CVSS vector v.4.0: 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N)
CVSS vector v.3.1: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Description: MobSF has a functionality of dividing users by roles. This functionality is not efficient, because any registered user can get API Token with all privileges.
Impact: Information Disclosure
Vulnerable component: Code output component (/source_code)
Exploitation conditions: authorized user
Mitigation: Remove token output in the returned js-script
Researcher: Egor Filatov (Positive Technologies)
Research
Researcher discovered zero-day vulnerability «Local Privilege Escalation» in Mobile Security Framework (MobSF). To reproduce the vulnerability follow the steps below.
• A user with minimal privileges is required, so the administrator must create a user account
<img width="215" alt="fig1" src="https://github.com/user-attachments/assets/43e02a50-bdd9-48d9-9194-73946fcc56d9" />Figure 1. Registration
• Go to static analysis of any application
<img width="1207" alt="fig2" src="https://github.com/user-attachments/assets/9ed141a7-a667-4a96-81fd-d81127874104" />Figure 2. Static analysis
• Go to the code review of the selected application and get a token with all privileges in the response
<img width="1400" alt="fig3" src="https://github.com/user-attachments/assets/bf8b704b-9067-4861-a7d3-05ec119d9a3f" />Figure 3. Token receiving
• This token can be used to retrieve dynamic analysis information that has not been accessed before.
Figure 4. No access demonstration
<img width="1412" alt="fig5" src="https://github.com/user-attachments/assets/dc8f639f-36b0-47d3-807d-58ae551fcbfc" />Figure 5. Token usage
As a result, the user is able to escalate the privileges.
Please, assign all credits to: Egor Filatov (Positive Technologies)
Affected packages
mobsf < 4.3.1
Remediation
Upgrade to a patched release:
mobsf 4.3.1
References
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-79f6-p65j-3m2m
- https://nvd.nist.gov/vuln/detail/CVE-2025-24805
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/05206e72cae35b311615a70e51e1a946955c5e83
- https://github.com/MobSF/Mobile-Security-Framework-MobSF
Related vulnerabilities
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-24804Medium· 6.5MobSF Partial Denial of Service (DoS)
same productshared advisory#osvCVE-2025-24803High· 8.1MobSF Stored Cross-Site Scripting (XSS)
same productshared advisory#osvCVE-2026-33545Medium· 5.3MobSF has SQL Injection in its SQLite Database Viewer Utils
same productshared advisory#osvCVE-2024-31215Medium· 6.3Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check
same productshared advisory#osvCVE-2025-46335MediumMobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
same productshared advisory#osvCVE-2022-41547High· 7.5MobSF allows attackers to read arbitrary files via a crafted HTTP request
same productshared advisory#osv
#osv#pip