MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1.

Affected: PyPI: mobsf

### Summary The vulnerability allows any user to overwrite any files available under the account privileges of the running process.

### Details As part of static analysis, iOS MobSF supports loading and parsing statically linked libraries `.a`. When parsing such archives, the code extracts the embedded objects to the file system in the working directory of the analysis. The problem is that the current implementation does not prohibit absolute file names inside `.a`. If an archive item has a name like /abs/path/to/file, the resulting path is constructed as Path(dst) /name; for absolute paths, this leads to a complete substitution of the destination directory: writing occurs directly to the specified absolute directory. the path (outside the working directory).

Thus, an authenticated user who uploaded a specially prepared `.a`, can write arbitrary files to any directory writable by the user of the MobSF process (for example, `/tmp`, neighboring directories inside `~/.MobSF`, etc.).

The key reason is that checking the "sliding" paths only takes into account the presence of `..` (relative traversal), but does not take into account the absoluteness of the name and does not compare the normalized target path with the root directory of the extraction.

### What exactly is vulnerable: **mobsf/StaticAnalyzer/views/common/shared_func.py** Function for extracting objects from `.a` — ar_extract ``` def ar_extract(checksum, src, dst): """Extract AR archive.""" ... ar = arp…

Affected: PyPI: mobsf

### Summary The vulnerability allows any user to overwrite any files available under the account privileges of the running process.

### Details As part of static analysis, iOS MobSF supports loading and parsing statically linked libraries `.a`. When parsing such archives, the code extracts the embedded objects to the file system in the working directory of the analysis. The problem is that the current implementation does not prohibit absolute file names inside `.a`. If an archive item has a name like /abs/path/to/file, the resulting path is constructed as Path(dst) /name; for absolute paths, this leads to a complete substitution of the destination directory: writing occurs directly to the specified absolute directory. the path (outside the working directory).

Thus, an authenticated user who uploaded a specially prepared `.a`, can write arbitrary files to any directory writable by the user of the MobSF process (for example, `/tmp`, neighboring directories inside `~/.MobSF`, etc.).

The key reason is that checking the "sliding" paths only takes into account the presence of `..` (relative traversal), but does not take into account the absoluteness of the name and does not compare the normalized target path with the root directory of the extraction.

### What exactly is vulnerable: **mobsf/StaticAnalyzer/views/common/shared_func.py** Function for extracting objects from `.a` — ar_extract ``` def ar_extract(checksum, src, dst): """Extract AR archive.""" ... ar = arp…