CVE-2024-52598: 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview
First published: Wed Nov 20 2024(Updated: )
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary URL, whose content will be stored in an image file in the server if it looks like an image. Additionally, the library does some basic validation on the URI, attempting to filter our URIs which do not have an image extension. However, this can be easily bypassed by appending the string `#.svg` to the URI. The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. If not, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SUSE YaST |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-52598?
CVE-2024-52598 is considered a high severity vulnerability due to its potential for SSRF and URI validation bypass exploits.
How do I fix CVE-2024-52598?
To fix CVE-2024-52598, update to the latest version of 2FAuth that addresses these vulnerabilities.
What are the main vulnerabilities associated with CVE-2024-52598?
CVE-2024-52598 involves a Server-Side Request Forgery (SSRF) and a URI validation bypass issue.
Which versions of 2FAuth are affected by CVE-2024-52598?
CVE-2024-52598 affects version 5.4.1 of the 2FAuth web application.
Can CVE-2024-52598 lead to unauthorized access?
Yes, CVE-2024-52598 can potentially allow an attacker to exploit the vulnerabilities for unauthorized access.
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/2fauth
- canonical/suse yast