CVE-2024-52598

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary URL, whose content will be stored in an image file in the server if it looks like an image. Additionally, the library does some basic validation on the URI, attempting to filter our URIs which do not have an image extension. However, this can be easily bypassed by appending the string `#.svg` to the URI. The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. If not, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues.

• CWE-79
• CWE-80
• CWE-918
• CWE-918

• https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4jExploit, Vendor Advisory

Published

Nov 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52592Misskey is an open source, federated social media platform. …5.3
• CVE-2024-52593Misskey is an open source, federated social media platform.I…5.3
• CVE-2024-52594Gomatrixserverlib is a Go library for matrix federation. Gom…4.3
• CVE-2024-52595lxml_html_clean is a project for HTML cleaning functionaliti…6.1
• CVE-2024-52596SimpleSAMLphp xml-common is a common classes for handling XM…8.8
• CVE-2024-525972FAuth is a web app to manage Two-Factor Authentication (2FA…6.1
• CVE-2024-52599Tuleap is an open source suite to improve management of soft…5.4
• CVE-2024-5260The Sina Extension for Elementor (Slider, Gallery, Form, Mod…5.4
• CVE-2024-52600Statmatic is a Laravel and Git powered content management sy…5.3
• CVE-2024-52601iTop is an web based IT Service Management tool. Prior to ve…6.5
• CVE-2024-52602Matrix Media Repo (MMR) is a highly configurable multi-homes…5.3
• CVE-2024-52606SolarWinds Platform is affected by server-side request forge…9.8