CVE-2024-52597: 2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render
First published: Wed Nov 20 2024(Updated: )
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim's session and access to their tokens. Version 5.4.1 contains a patch for the issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SUSE YaST | <5.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-52597?
CVE-2024-52597 has been classified as a high-severity vulnerability due to the risk of stored cross-site scripting.
How do I fix CVE-2024-52597?
To fix CVE-2024-52597, upgrade to version 5.4.1 or later of the 2FAuth application.
What types of attacks can exploit CVE-2024-52597?
CVE-2024-52597 can be exploited to perform stored cross-site scripting attacks, potentially allowing attackers to execute arbitrary scripts in users' browsers.
Which versions of 2FAuth are affected by CVE-2024-52597?
CVE-2024-52597 affects all versions of 2FAuth prior to 5.4.1.
What components of the 2FAuth application are vulnerable in CVE-2024-52597?
The vulnerability in CVE-2024-52597 is due to improper handling of headers when directly accessing uploaded SVG files.
- agent/weakness
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/2fauth
- canonical/suse yast