{"id":"PYSEC-2026-1677","summary":"SSRF Vulnerability on assetlinks_check(act_name, well_knowns)","details":"### Summary\nWhile examining the \"App Link assetlinks.json file could not be found\" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the \"/.well-known/assetlinks.json\" endpoint for all hosts written with \"android:host\". In the AndroidManifest.xml file.\n\nSince MobSF does not perform any input validation when extracting the hostnames in \"android:host\", requests can also be sent to local hostnames. This may cause SSRF vulnerability.\n\n### Details\nExample \u003cintent-filter structure in AndroidManifest.xml:\n\n```\n\u003cintent-filter android:autoVerify=\"true\"\u003e\n\u003caction android:name=\"android.intent.action.VIEW\" /\u003e\n\u003ccategory android:name=\"android.intent.category.DEFAULT\" /\u003e\n\u003ccategory android:name=\"android.intent.category.BROWSABLE\" /\u003e\n\u003cdata android:host=\"192.168.1.102/user/delete/1#\" android:scheme=\"http\" /\u003e\n\u003c/intent-filter\u003e\n```\n\n\nWe defined it as android:host=\"192.168.1.102/user/delete/1#\". Here, the \"#\" character at the end of the host prevents requests from being sent to the \"/.well-known/assetlinks.json\" endpoint and ensures that requests are sent to the endpoint before it.\n\n\n\u003cimg width=\"617\" alt=\"image\" src=\"https://github.com/MobSF/Mobile-Security-Framework-MobSF/assets/150332295/c570cb00-e947-4ad7-af80-26d46c0ad3f7\"\u003e\n\n\n### PoC\nhttps://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link\n\n\n### Impact\nThe attacker can cause the server to make a connection to internal-only services within the organization's infrastructure.","aliases":["CVE-2024-29190","GHSA-wfgj-wrgh-h3r3","PYSEC-2024-257"],"modified":"2026-07-07T17:57:13.268082861Z","published":"2026-07-07T11:45:36.233070Z","references":[{"type":"WEB","url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29190"},{"type":"WEB","url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77"},{"type":"WEB","url":"https://github.com/MobSF/mobsfscan/commit/61fd40b477bbf9d204eb8c5a83a86c396d839798"},{"type":"WEB","url":"https://github.com/MobSF/mobsfscan/commit/cd01b71770a6e56c1c71b0e5f454e7b6c9c64ef4"},{"type":"WEB","url":"https://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link"},{"type":"PACKAGE","url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2024-257.yaml"},{"type":"PACKAGE","url":"https://pypi.org/project/mobsfscan"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wfgj-wrgh-h3r3"}],"affected":[{"package":{"name":"mobsfscan","ecosystem":"PyPI","purl":"pkg:pypi/mobsfscan"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.8"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.1.0","0.1.1","0.1.2","0.1.3","0.2.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/mobsfscan/PYSEC-2026-1677.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}