CVE-2026-68927

## Summary MobSF's Android App Link assetlinks checker validates only the manifest `android:host` value with `valid_host()`, but then appends the separate `android:port` value into the URL used for the server-side request. This bypasses the current port restriction in `valid_host()` and lets a crafted APK cause MobSF to fetch `http://host:<attacker-port>/.well-known/assetlinks.json` or `https://host:<attacker-port>/.well-known/assetlinks.json`. ## Impact An authenticated user who can upload or trigger analysis of a crafted APK can cause the MobSF server to make an outbound request to an attacker-selected port during Android manifest analysis. When the host is controlled by the attacker and uses DNS rebinding, the validation lookup can resolve to a public IP while the later HTTP client lookup resolves to an internal address, allowing SSRF to internal services on non-80/443 ports. This is not arbitrary URL SSRF. The path remains fixed to `/.well-known/assetlinks.json`, and redirects are disabled. The bypass is that the final fetched URL is assembled after the host-only validation, so the current port guard is not applied to the actual URL. ## Root cause `valid_host()` rejects ports other than 80 and 443 when a port is included in the string being validated: ```python port = parsed.port ... if port and port not in (80, 443): return False ``` In `get_browsable_activities()`, only the host attribute is passed to `valid_host()`: ```python host = data.getAttribute(f'{ns}:host') port = data.getAttribute(f'{ns}:port') ... if not valid_host(host): logger.warning('Invalid Host: %s', host) continue shost = f'{scheme}://{host}' if port and is_number(port): c_url = f'{shost}:{port}{WELL_KNOWN_PATH}' else: c_url = f'{shost}{WELL_KNOWN_PATH}' well_known[c_url] = shost ``` `_check_url()` then fetches the assembled URL after checking only path, query, and params: ```python purl = urlparse(url) if (purl.path != WELL_KNOWN_PATH or len(purl.query) > 0