MobSF versions before 4.5.1 contain an SSRF vulnerability in the get_browsable_activities function within android manifest analysis. The function validates the android:host value but appends a separately supplied android:port to the URL fetched by _check_url without sufficient validation. An authenticated user can upload a crafted APK that causes the server to make requests to an attacker-chosen hostname and nonstandard port at the fixed path /.well-known/assetlinks.json. DNS rebinding between validation and the HTTP request allows the request to reach internal services. Redirects are disabled, and the path is fixed, limiting the scope. The vulnerability is addressed in version 4.5.1.

An authenticated user can exploit this SSRF vulnerability to make the server send requests to internal services on nonstandard ports, potentially accessing internal resources that are otherwise inaccessible. The impact is limited by the requirement for authentication, the fixed request path, and disabled redirects. The CVSS score is 3.0 (low severity), reflecting limited confidentiality impact and no integrity or availability impact.

This vulnerability is fixed in MobSF version 4.5.1. Users should upgrade to version 4.5.1 or later to remediate this issue. No other mitigation or workaround is indicated by the vendor advisory.