MobSF Mobile-Security-Framework-MobSF versions before 4.5.1 improperly configure the Django CSRF middleware by placing it only in the deprecated MIDDLEWARE_CLASSES setting and not in the active MIDDLEWARE tuple. This misconfiguration allows remote attackers to exploit CSRF by causing authenticated users to submit cross-site POST requests to sensitive endpoints like /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. Successful exploitation can result in unauthorized modification or deletion of scans, application uploads/downloads, password changes, and user management actions under the victim's account privileges. The issue is resolved in version 4.5.1.

Exploitation of this CSRF vulnerability allows attackers to perform unauthorized actions on behalf of authenticated users without their consent. These actions include deleting scans, uploading or downloading applications, changing user passwords, and managing user accounts. The impact is limited to the permissions of the victim user and does not affect confidentiality but can cause integrity violations. The CVSS score of 6.5 (medium severity) reflects the ease of attack and the potential for significant impact on integrity.

Upgrade MobSF Mobile-Security-Framework-MobSF to version 4.5.1 or later, where the CSRF middleware is correctly configured in the active MIDDLEWARE setting. This official fix addresses the vulnerability. No additional mitigation steps are required once the update is applied.