MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.

Affected: PyPI: mobsf

### Summary

Django's `CsrfViewMiddleware` exists only in the deprecated `MIDDLEWARE_CLASSES` (ignored since Django 2.0). The active `MIDDLEWARE` tuple does not include it. All authenticated web POST endpoints (delete scan, upload, download APK, change password, manage users) accept requests without CSRF tokens.

### Verified Impact

This was verified by **actually deleting a real scan** from the running server using only a session cookie — no CSRF token was required:

``` $ curl -s -b cookies.txt -X POST "http://127.0.0.1:8000/delete_scan/" \ -d "md5=68e76627798d62555d5287f4488a32c7&scan_type=apk" {"deleted": "yes"} ```

The scan was removed from the database. This attack works from any website via HTML form auto-submission because: - **No CSRF token is validated** (middleware absent) - **Cookie `SameSite=Lax`** allows form-based top-level navigation to send the session cookie

### Affected Component

``` File: mobsf/MobSF/settings.py (Lines 206-212)

MIDDLEWARE = ( 'mobsf.MobSF.views.api.api_middleware.RestApiAuthMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', # MISSING: 'django.middleware.csrf.CsrfViewMiddleware' ) ```

### Steps to Reproduce

**1.** Start MobSF v4.4.6 and log in at `http://127.0.0.1:8000/login/` (creds: `mobsf/mobsf`).

**2.** Upload and scan any APK to create a scan entry. Note the MD5 hash from…

Affected: PyPI: mobsf

### Summary

Django's `CsrfViewMiddleware` exists only in the deprecated `MIDDLEWARE_CLASSES` (ignored since Django 2.0). The active `MIDDLEWARE` tuple does not include it. All authenticated web POST endpoints (delete scan, upload, download APK, change password, manage users) accept requests without CSRF tokens.

### Verified Impact

This was verified by **actually deleting a real scan** from the running server using only a session cookie — no CSRF token was required:

``` $ curl -s -b cookies.txt -X POST "http://127.0.0.1:8000/delete_scan/" \ -d "md5=68e76627798d62555d5287f4488a32c7&scan_type=apk" {"deleted": "yes"} ```

The scan was removed from the database. This attack works from any website via HTML form auto-submission because: - **No CSRF token is validated** (middleware absent) - **Cookie `SameSite=Lax`** allows form-based top-level navigation to send the session cookie

### Affected Component

``` File: mobsf/MobSF/settings.py (Lines 206-212)

MIDDLEWARE = ( 'mobsf.MobSF.views.api.api_middleware.RestApiAuthMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', # MISSING: 'django.middleware.csrf.CsrfViewMiddleware' ) ```

### Steps to Reproduce

**1.** Start MobSF v4.4.6 and log in at `http://127.0.0.1:8000/login/` (creds: `mobsf/mobsf`).

**2.** Upload and scan any APK to create a scan entry. Note the MD5 hash from…