CVE-2024-29190: SSRF Vulnerability on assetlinks_check(act_name, well_knowns)

While examining the “App Link assetlinks.json file could not be found” vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the “/.well-known/assetlinks.json” endpoint for all hosts written with “android:host”. In the AndroidManifest.xml file.

Since MobSF does not perform any input validation when extracting the hostnames in “android:host”, requests can also be sent to local hostnames. This may cause SSRF vulnerability.