[HOTFIX][SECURITY] Fix an LFI, DSA Pub Key parsing bug and dependencies

.github/SECURITY.md

@@ -18,7 +18,8 @@ Please report all security issues [here](https://github.com/MobSF/Mobile-Securit
 
 | Vulnerability | Affected Versions |
 | ------- | ------------------ |
+| [Arbitrary Local file read in APK icon resource](https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/a58f8a8c0aa49e1581d97e19e8e2255ca96cd838)  | `>=1.0.4, <=3.9.2` |
 | [Remote Code Execution via arbitrary file overwrite vulnerability in apktool <2.9.2](https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/19c1b55c2c59596f2d43439926c9dc976cbeaec4),  [[CVE-2024-21633]](https://github.com/0x33c0unt/CVE-2024-21633) | `<=3.9.1` |
 | [Arbitrary Local file read regression](https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/1197)  | `<3.0.0` |
-| [Upload a malicious zip file can overwrite arbitary files](https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/358)  | `>=0.9.3.2` && `<=0.9.4.1` |
+| [Upload a malicious zip file can overwrite arbitary files](https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/358)  | `>=0.9.3.2, <=0.9.4.1` |
 | [Arbitrary Local file read](https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/166) | `<=0.9.2` |

mobsf/MobSF/init.py

@@ -10,7 +10,7 @@
 
 logger = logging.getLogger(__name__)
 
-VERSION = '3.9.2'
+VERSION = '3.9.3'
 BANNER = """
   __  __       _    ____  _____       _____ ___  
  |  \/  | ___ | |__/ ___||  ___|_   _|___ // _ \ 

mobsf/StaticAnalyzer/views/android/cert_analysis.py

@@ -104,9 +104,9 @@ def get_pub_key_details(data):
     elif isinstance(x509_public_key, dsa.DSAPublicKey):
         alg = 'dsa'
         dsa_parameters = x509_public_key.parameters()
-        p = dsa_parameters.p
-        q = dsa_parameters.q
-        g = dsa_parameters.g
+        p = dsa_parameters.parameter_numbers().p
+        q = dsa_parameters.parameter_numbers().q
+        g = dsa_parameters.parameter_numbers().g
         y = x509_public_key.public_numbers().y
         to_hash = f'{p}:{q}:{g}:{y}'
     elif isinstance(x509_public_key, ec.EllipticCurvePublicKey):

mobsf/StaticAnalyzer/views/android/icon_analysis.py

@@ -20,6 +20,7 @@
 from mobsf.MobSF.utils import (
     find_java_binary,
     is_file_exists,
+    is_path_traversal,
 )
 
 
@@ -156,6 +157,8 @@ def get_icon_src(a, app_dic, res_dir):
         icon_name = None
         if a:
             icon_name = a.get_app_icon(max_dpi=icon_resolution)
+            if is_path_traversal(icon_name):
+                icon_name = None
         if not icon_name:
             # androguard cannot find icon file.
             icon_name = ''
@@ -196,6 +199,9 @@ def get_icon_src(a, app_dic, res_dir):
         if icon_src.endswith('.xml'):
             logger.warning('Cannot find icon file from xml')
             icon_src = ''
+        elif not icon_src.endswith(('.png', '.svg', '.webp')):
+            logger.warning('Cannot find a valid icon file')
+            icon_src = ''
         if not icon_name:
             logger.warning('Cannot find icon file')
             icon_src = ''

mobsf/StaticAnalyzer/views/android/manifest_analysis.py

@@ -97,7 +97,7 @@ def _check_url(host, w_url):
                 'status': status}
 
     except Exception:
-        logger.exception(f'Well Known Assetlinks Check for URL: {w_url}')
+        logger.error(f'Well Known Assetlinks Check for URL: {w_url}')
         return {'url': w_url, 
                 'host': host,
                 'status_code': None,

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "mobsf"
-version = "3.9.2"
+version = "3.9.3"
 description = "Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis."
 keywords = ["mobsf", "mobile security framework", "mobile security", "security tool", "static analysis", "dynamic analysis", "malware analysis"]
 authors = ["Ajin Abraham <ajin@opensecurity.in>"]