MobSF Path Traversal Vulnerability in File Download Route

A path traversal vulnerability has been identified in MobSF version 4.4.0. The issue arises in the GET /download/ route, where string path verification is performed using os.path.commonprefix. This flaw allows an authenticated user to download files from sibling directories adjacent to the DWD_DIR download directory, as long as the absolute paths of those directories share the same prefix as DWD_DIR. The vulnerability can lead to unauthorized access to sensitive files, creating a data leak.

Impact

Exploitation of this vulnerability allows authenticated users to download files from directories adjacent to the designated download directory, potentially leading to unauthorized access to sensitive information.

Reproduction

To reproduce this vulnerability, an authenticated user can send a GET request to the /download/ route with an absolute path that points to a file in a sibling directory of the DWD_DIR. The request must include a session cookie to authenticate the user. The server will respond with the requested file if the path traversal is successful.

Remediation

Users can upgrade to MobSF version 4.4.1, where this vulnerability has been patched.