A stored cross-site scripting vulnerability in MobSF allows attackers to execute arbitrary code and potentially hijack user sessions, necessitating an immediate update to version 4.4.5.

This vulnerability, classified as CWE-79, occurs because the application fails to sanitize the android:host attribute during Android manifest analysis. An authenticated user with sufficient privileges can trigger this flaw by uploading a crafted APK, resulting in the execution of malicious scripts within the context of a victim session.

Successful exploitation permits an attacker to perform unauthorized actions on behalf of the victim, leading to session hijacking and full account takeover. Given the CVSS score of 8.1, this vulnerability poses a high risk to the integrity and confidentiality of the testing platform, potentially allowing unauthorized access to sensitive mobile application analysis data.

Immediate Action: Update the MobSF installation to version 4.4.5 or later to resolve the underlying sanitization flaw.

Proactive Monitoring: Review web application access logs for unusual APK upload patterns or unauthorized JavaScript execution attempts.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block suspicious cross-site scripting payloads in uploaded file metadata.

Public Exploit Available: Unknown.

The severity of this vulnerability is significant, particularly in environments where MobSF is utilized to analyze untrusted mobile applications. Administrators should prioritize the update to version 4.4.5 as the primary defense against potential session hijacking and account compromise. Immediate patching is strongly advised to maintain the security posture of the application testing lifecycle.