mobsf 4.3.0__tar.gz → 4.3.2__tar.gz

{mobsf-4.3.0 → mobsf-4.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: mobsf
-Version: 4.3.0
+Version: 4.3.2
 Summary: Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
 Home-page: https://github.com/MobSF/Mobile-Security-Framework-MobSF
 License: GPL-3.0-only
@@ -54,7 +54,8 @@ Requires-Dist: svgutils (>=0.3.4)
 Requires-Dist: tldextract (>=5.1.3)
 Requires-Dist: tzdata (>=2023.3,<2024.0)
 Requires-Dist: waitress (>=3.0.1) ; sys_platform == "win32"
-Requires-Dist: whitenoise (>=5.2.0)
+Requires-Dist: whitenoise (>=6.8.2)
+Requires-Dist: xmlsec (==1.3.14)
 Project-URL: Bug Tracker, https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues
 Project-URL: Documentation, https://mobsf.github.io/docs/
 Project-URL: Repository, https://github.com/MobSF/Mobile-Security-Framework-MobSF

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/DynamicAnalyzer/views/android/frida_server_download.py

@@ -30,7 +30,7 @@ def clean_up_old_binaries(dirc, version):
                 pass
 
 
-def download_frida_server(url, version, fname, proxies):
+def download_frida_server(url, version, fname, proxies, verify):
     """Download frida-server-binary."""
     try:
         download_dir = Path(settings.DWD_DIR)
@@ -40,6 +40,7 @@ def download_frida_server(url, version, fname, proxies):
                 url,
                 timeout=5,
                 proxies=proxies,
+                verify=verify,
                 stream=True) as r:
             with LZMAFile(r.raw) as f:
                 with open(dwd_loc, 'wb') as flip:
@@ -72,7 +73,7 @@ def update_frida_server(arch, version):
         for item in response.json()['assets']:
             if item['name'] == f'{fserver}.xz':
                 url = item['browser_download_url']
-                return download_frida_server(url, version, fserver, proxies)
+                return download_frida_server(url, version, fserver, proxies, verify)
         return False
     except Exception:
         logger.exception('[ERROR] Fetching Frida Server Release')

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/DynamicAnalyzer/views/ios/corellium_instance.py

@@ -763,6 +763,8 @@ def download_data(request, bundle_id, api=False):
         if failed:
             return send_response(failed, api)
         if not strict_package_check(bundle_id):
+            # Check bundle_id during call, as the check
+            # is not done in REST API/URL repath.
             data['message'] = 'Invalid iOS Bundle id'
             return send_response(data, api)
         ci = CorelliumInstanceAPI(instance_id)

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/DynamicAnalyzer/views/ios/report.py

@@ -49,8 +49,9 @@ def ios_view_report(request, bundle_id, api=False):
         else:
             dev = ''
         if not strict_package_check(bundle_id):
-            # We need this check since bundleid
-            # is not validated in REST API
+            # bundle_id is not validated in REST API.
+            # Also bundleid is not strictly validated
+            # in URL path.
             return print_n_send_error_response(
                 request,
                 'Invalid iOS Bundle id',

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/MobSF/init.py

@@ -18,7 +18,7 @@ from mobsf.install.windows.setup import windows_config_local
 
 logger = logging.getLogger(__name__)
 
-VERSION = '4.3.0'
+VERSION = '4.3.2'
 BANNER = r"""
   __  __       _    ____  _____       _  _    _____ 
  |  \/  | ___ | |__/ ___||  ___|_   _| || |  |___ / 

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/MobSF/security.py

@@ -3,10 +3,13 @@ import subprocess
 import functools
 import logging
 import re
+import socket
+import ipaddress
 import sys
 from shutil import which
 from pathlib import Path
 from platform import system
+from urllib.parse import urlparse
 from concurrent.futures import ThreadPoolExecutor
 
 from mobsf.MobSF.utils import (
@@ -249,3 +252,77 @@ def sanitize_for_logging(filename: str, max_length: int = 255) -> str:
 
     # Truncate filename to the maximum allowed length
     return filename[:max_length]
+
+
+def valid_host(host):
+    """Check if host is valid, run SSRF checks."""
+    default_timeout = socket.getdefaulttimeout()
+    try:
+        if len(host) > 2083:  # Standard URL length limit
+            return False
+
+        prefixs = ('http://', 'https://')
+        if not host.startswith(prefixs):
+            host = f'http://{host}'
+        parsed = urlparse(host)
+        scheme = parsed.scheme
+        domain = parsed.netloc
+        hostname = parsed.hostname
+        path = parsed.path
+        query = parsed.query
+        params = parsed.params
+        port = parsed.port
+
+        # Allow only http and https schemes
+        if scheme not in ('http', 'https'):
+            return False
+
+        # Check for hostname
+        if not hostname:
+            return False
+
+        # Validate port - only allow 80 and 443
+        if port and port not in (80, 443):
+            return False
+
+        # Check for URL credentials
+        if '@' in domain:
+            return False
+
+        # Detect parser escapes, only host is allowed
+        if len(path) > 0 or len(query) > 0 or len(params) > 0:
+            return False
+
+        # Resolve dns to get ipv4 or ipv6 address
+        socket.setdefaulttimeout(5)  # 5 second timeout
+        ip_addresses = socket.getaddrinfo(hostname, None)
+        for ip in ip_addresses:
+            ip_obj = ipaddress.ip_address(ip[4][0])
+            if (ip_obj.is_private
+                or ip_obj.is_loopback
+                or ip_obj.is_link_local
+                or ip_obj.is_reserved
+                or ip_obj.is_multicast
+                    or ip_obj.is_unspecified):
+                return False
+
+            # Additional checks for specific IPv4 ranges
+            if isinstance(ip_obj, ipaddress.IPv4Address):
+                problematic_networks = [
+                    '127.0.0.0/8',
+                    '169.254.0.0/16',
+                    '172.16.0.0/12',
+                    '192.168.0.0/16',
+                    '10.0.0.0/8',
+                ]
+                for network in problematic_networks:
+                    if ip_obj in ipaddress.IPv4Network(network):
+                        return False
+
+        # If all checks pass, return True
+        return True
+    except Exception:
+        return False
+    finally:
+        # Restore default socket timeout
+        socket.setdefaulttimeout(default_timeout)

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/MobSF/settings.py

@@ -379,6 +379,8 @@ IDP_ENTITY_ID = os.getenv('MOBSF_IDP_ENTITY_ID')
 IDP_SSO_URL = os.getenv('MOBSF_IDP_SSO_URL')
 IDP_X509CERT = os.getenv('MOBSF_IDP_X509CERT')
 IDP_IS_ADFS = os.getenv('MOBSF_IDP_IS_ADFS', '0')
+IDP_MAINTAINER_GROUP = os.getenv('MOBSF_IDP_MAINTAINER_GROUP', 'Maintainer')
+IDP_VIEWER_GROUP = os.getenv('MOBSF_IDP_VIEWER_GROUP', 'Viewer')
 # SP Configuration
 SP_HOST = os.getenv('MOBSF_SP_HOST')
 SP_ALLOW_PASSWORD = os.getenv('MOBSF_SP_ALLOW_PASSWORD', '0')

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/MobSF/urls.py

@@ -52,7 +52,7 @@ from mobsf.StaticAnalyzer.views.ios.views import view_source as io_view_source
 
 from . import settings
 
-bundle_id_regex = r'(?P<bundle_id>([a-zA-Z0-9]{1}[\w.-]{1,255}))$'
+bundle_id_regex = r'(?P<bundle_id>.+)$'
 checksum_regex = r'(?P<checksum>[0-9a-f]{32})'
 paginate = r'(?P<page_size>[0-9]{1,10})/(?P<page_number>[0-9]{1,10})'
 

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/MobSF/utils.py

@@ -16,11 +16,9 @@ import signal
 import string
 import subprocess
 import stat
-import socket
 import sqlite3
 import unicodedata
 import threading
-from urllib.parse import urlparse
 from pathlib import Path
 from concurrent.futures import (
     ThreadPoolExecutor,
@@ -904,58 +902,6 @@ def id_generator(size=6, chars=string.ascii_uppercase + string.digits):
     return ''.join(random.choice(chars) for _ in range(size))
 
 
-def valid_host(host):
-    """Check if host is valid."""
-    try:
-        prefixs = ('http://', 'https://')
-        if not host.startswith(prefixs):
-            host = f'http://{host}'
-        parsed = urlparse(host)
-        domain = parsed.netloc
-        path = parsed.path
-        if len(domain) == 0:
-            # No valid domain
-            return False
-        if len(path) > 0:
-            # Only host is allowed
-            return False
-        if ':' in domain:
-            # IPv6
-            return False
-        # Local network
-        invalid_prefix = (
-            '100.64.',
-            '127.',
-            '192.',
-            '198.',
-            '10.',
-            '172.',
-            '169.',
-            '0.',
-            '203.0.',
-            '224.0.',
-            '240.0',
-            '255.255.',
-            'localhost',
-            '::1',
-            '64::ff9b::',
-            '100::',
-            '2001::',
-            '2002::',
-            'fc00::',
-            'fe80::',
-            'ff00::')
-        if domain.startswith(invalid_prefix):
-            return False
-        ip = socket.gethostbyname(domain)
-        if ip.startswith(invalid_prefix):
-            # Resolve dns to get IP
-            return False
-        return True
-    except Exception:
-        return False
-
-
 def append_scan_status(checksum, status, exception=None):
     """Append Scan Status to Database."""
     try:

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/MobSF/views/authorization.py

@@ -49,8 +49,8 @@ class Permissions(Enum):
     DELETE = f'StaticAnalyzer.{PERM_CAN_DELETE}'
 
 
-MAINTAINER_GROUP = 'Maintainer'
-VIEWER_GROUP = 'Viewer'
+MAINTAINER_GROUP = settings.IDP_MAINTAINER_GROUP
+VIEWER_GROUP = settings.IDP_VIEWER_GROUP
 
 
 def permission_required(perm):

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/StaticAnalyzer/views/android/manifest_analysis.py

@@ -2,6 +2,7 @@
 # flake8: noqa
 """Module for android manifest analysis."""
 import logging
+from urllib.parse import urlparse
 
 import requests
 from concurrent.futures import ThreadPoolExecutor
@@ -10,8 +11,8 @@ from mobsf.MobSF.utils import (
     append_scan_status,
     is_number,
     upstream_proxy,
-    valid_host,
 )
+from mobsf.MobSF.security import valid_host
 from mobsf.StaticAnalyzer.views.android import (
     network_security,
 )
@@ -27,6 +28,8 @@ ANDROID_8_0_LEVEL = 26
 ANDROID_9_0_LEVEL = 28
 ANDROID_10_0_LEVEL = 29
 ANDROID_MANIFEST_FILE = 'AndroidManifest.xml'
+WELL_KNOWN_PATH = '/.well-known/assetlinks.json'
+
 ANDROID_API_LEVEL_MAP = {
     '1': '1.0',
     '2': '1.1',
@@ -96,6 +99,14 @@ def _check_url(host, w_url):
             urls.add(f'https://{w_url[7:]}')
 
         for url in urls:
+            # Additional checks to ensure that
+            # the final path is WELL_KNOWN_PATH
+            purl = urlparse(url)
+            if (purl.path != WELL_KNOWN_PATH
+                or len(purl.query) > 0
+                    or len(purl.params) > 0):
+                logger.warning('Invalid Assetlinks URL: %s', url)
+                continue
             r = requests.get(url,
                              timeout=5,
                              allow_redirects=False,
@@ -134,7 +145,6 @@ def get_browsable_activities(node, ns):
         path_prefixs = []
         path_patterns = []
         well_known = {}
-        well_known_path = '/.well-known/assetlinks.json'
         catg = node.getElementsByTagName('category')
         for cat in catg:
             if cat.getAttribute(f'{ns}:name') == 'android.intent.category.BROWSABLE':
@@ -168,12 +178,13 @@ def get_browsable_activities(node, ns):
                             and host != '*'):
                         host = host.replace('*.', '').replace('#', '')
                         if not valid_host(host):
+                            logger.warning('Invalid Host: %s', host)
                             continue
                         shost = f'{scheme}://{host}'
                         if port and is_number(port):
-                            c_url = f'{shost}:{port}{well_known_path}'
+                            c_url = f'{shost}:{port}{WELL_KNOWN_PATH}'
                         else:
-                            c_url = f'{shost}{well_known_path}'
+                            c_url = f'{shost}{WELL_KNOWN_PATH}'
                         well_known[c_url] = shost
         schemes = [scheme + '://' for scheme in schemes]
         browse_dic['schemes'] = schemes

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/StaticAnalyzer/views/android/views/source_tree.py

@@ -10,7 +10,6 @@ from django.shortcuts import (
     render,
 )
 
-from mobsf.MobSF.init import api_key
 from mobsf.MobSF.utils import (
     is_md5,
     print_n_send_error_response,
@@ -71,7 +70,6 @@ def run(request):
             'hash': md5,
             'source_type': typ,
             'version': settings.MOBSF_VER,
-            'api_key': api_key(settings.MOBSF_HOME),
         }
         template = 'static_analysis/source_tree.html'
         return render(request, template, context)

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/StaticAnalyzer/views/android/views/view_source.py

@@ -1,6 +1,5 @@
 # -*- coding: utf_8 -*-
 """View Source of a file."""
-
 import logging
 import ntpath
 from pathlib import Path
@@ -8,6 +7,7 @@ from pathlib import Path
 from django.conf import settings
 from django.shortcuts import render
 from django.utils.html import escape
+from django.http import JsonResponse
 
 from mobsf.MobSF.forms import FormUtil
 from mobsf.MobSF.utils import (
@@ -28,9 +28,26 @@ from mobsf.MobSF.views.authentication import (
 logger = logging.getLogger(__name__)
 
 
+def send_json(data):
+    return JsonResponse(data, safe=False)
+
+
+def send_error(request, err, api_mode, json_resp, exp=None):
+    """Send error message as dict or JSON."""
+    if exp:
+        res = print_n_send_error_response(request, err, api_mode, exp)
+    else:
+        res = print_n_send_error_response(request, err, api_mode)
+    if json_resp:
+        return send_json(res)
+    return res
+
+
 @login_required
 def run(request, api=False):
     """View the source of a file."""
+    json_resp = request.GET.get('json', '0') == '1'
+    api_mode = api or json_resp
     try:
         logger.info('View Java Source File')
         exp = 'Error Description'
@@ -46,8 +63,7 @@ def run(request, api=False):
             viewsource_form = ViewSourceAndroidForm(request.GET)
         if not viewsource_form.is_valid():
             err = FormUtil.errors_message(viewsource_form)
-            return print_n_send_error_response(request, err, api, exp)
-
+            return send_error(request, err, api_mode, json_resp, exp)
         base = Path(settings.UPLD_DIR) / md5
         if typ == 'smali':
             src = base / 'smali_source'
@@ -57,12 +73,12 @@ def run(request, api=False):
                 src, syntax, _ = find_java_source_folder(base)
             except StopIteration:
                 msg = 'Invalid directory or file extension'
-                return print_n_send_error_response(request, msg, api)
+                return send_error(request, msg, api_mode, json_resp)
 
         sfile = src / fil
         if not is_safe_path(src, sfile.as_posix()):
             msg = 'Path Traversal Detected!'
-            return print_n_send_error_response(request, msg, api)
+            return send_error(request, msg, api_mode, json_resp)
         context = {
             'title': escape(ntpath.basename(fil)),
             'file': escape(ntpath.basename(fil)),
@@ -72,11 +88,13 @@ def run(request, api=False):
             'version': settings.MOBSF_VER,
         }
         template = 'general/view.html'
-        if api:
+        if json_resp:
+            return send_json(context)
+        if api_mode:
             return context
         return render(request, template, context)
     except Exception as exp:
         logger.exception('Error Viewing Source')
         msg = str(exp)
         exp = exp.__doc__
-        return print_n_send_error_response(request, msg, api, exp)
+        return send_error(request, msg, api_mode, json_resp, exp)

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/StaticAnalyzer/views/common/firebase.py

@@ -5,8 +5,8 @@ from urllib.parse import urlparse
 from mobsf.MobSF.utils import (
     append_scan_status,
     upstream_proxy,
-    valid_host,
 )
+from mobsf.MobSF.security import valid_host
 
 import requests
 
@@ -80,13 +80,12 @@ def firebase_analysis(checksum, code_an_dic):
 def open_firebase(checksum, url):
     # Detect Open Firebase Database
     try:
-        invalid = 'Invalid Firebase URL'
         if not valid_host(url):
-            logger.warning(invalid)
+            logger.warning('Invalid Host: %s', url)
             return url, False
         purl = urlparse(url)
-        if not purl.netloc.endswith('firebaseio.com'):
-            logger.warning(invalid)
+        if not purl.netloc.lower().endswith('.firebaseio.com'):
+            logger.warning('Invalid Firebase URL')
             return url, False
         base_url = f'{purl.scheme}://{purl.netloc}/.json'
         proxies, verify = upstream_proxy('https')
@@ -116,7 +115,7 @@ def firebase_db_check(checksum, code_an_dic):
     try:
         urls = list(set(code_an_dic['urls_list']))
         for url in urls:
-            if 'firebaseio.com' not in url:
+            if '.firebaseio.com' not in url:
                 continue
             returl, is_open = open_firebase(checksum, url)
             if is_open:

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/templates/dynamic_analysis/ios/dynamic_analysis.html

@@ -403,7 +403,7 @@ function list_apps(){
                                   <td><p>
                                       <a class="btn btn-success disable" onclick="dynamic_loader()" href="${url}"><i class="fab fa-apple"></i> Start Dynamic Analysis</a> 
                                       <a class="btn btn-info ${buttonState}" href="../../ios/view_report/${escapeHtml(bundle)}"><i class="fa fa-mobile"></i> View Report </a>
-                                      <a class="btn btn-warning" id="${$('#ios_dynamic').val()}" onclick="remove_app(this, '${bundle}')"><i class="fas fa-trash-alt"></i>  Uninstall</a>
+                                      <a class="btn btn-warning" id="${$('#ios_dynamic').val()}" onclick="remove_app(this, '${escapeHtml(bundle)}')"><i class="fas fa-trash-alt"></i>  Uninstall</a>
                                       </p>
                                   </td></tr>`);
                         }

{mobsf-4.3.0 → mobsf-4.3.2}/mobsf/templates/static_analysis/source_tree.html

@@ -275,17 +275,9 @@ const get_lines = function() {
 
 function show_file(strPath) {
     $.ajax({
-        type: "POST",
-        url: "{% url "api_view_source" %}",
+        type: "GET",
+        url: "{% url "view_source" %}?json=1&md5={{ hash }}&type={{ source_type }}&file=" + strPath,
         dataType: 'json',
-        headers: {
-            "Authorization": "{{ api_key }}"
-        },
-        data: {
-            type: "{{ source_type }}",
-            hash: "{{ hash }}",
-            file: strPath
-        },
         success: function(strFileData) {
             var code_block = $("pre#fileoutput")
             code_block.text(strFileData.data);

{mobsf-4.3.0 → mobsf-4.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "mobsf"
-version = "4.3.0"
+version = "4.3.2"
 description = "Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis."
 keywords = ["mobsf", "mobile security framework", "mobile security", "security tool", "static analysis", "dynamic analysis", "malware analysis"]
 authors = ["Ajin Abraham <ajin@opensecurity.in>"]
@@ -31,7 +31,7 @@ requests = ">=2.25.1"
 bs4 = ">=0.0.1"
 colorlog = ">=4.7.2"
 macholib = ">=1.14"
-whitenoise = ">=5.2.0"
+whitenoise = ">=6.8.2"
 waitress = {version = ">=3.0.1", markers = "sys_platform == 'win32'"}
 gunicorn = {version = ">=20.0.4", markers = "sys_platform != 'win32'"}
 psutil = ">=5.8.0"
@@ -61,6 +61,7 @@ packaging = ">=24.2"
 django-ratelimit = "^4.1.0"
 django-q2 = "^1.7.4"
 defusedxml = "^0.7.1"
+xmlsec = "1.3.14" # Remove this after xmlsec issue is resolved: https://github.com/xmlsec/python-xmlsec/issues/345
 
 [build-system]
 requires = ["poetry-core"]