CVE-2024-52598: 2fauth server-side request forgery (SSRF) (CVSS 7.5)

Description

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary URL, whose content will be stored in an image file in the server if it looks like an image. Additionally, the library does some basic validation on the URI, attempting to filter our URIs which do not have an image extension. However, this can be easily bypassed by appending the string `#.svg` to the URI. The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. If not, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

2fauth< 5.4.1

Remediation

Fixed in

2fauth≥ 5.4.1

Patch & vendor advisories

https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4j

References

https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4jExploitVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-52598 being actively exploited?

CVE-2024-52598 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.59%.

How severe is CVE-2024-52598?

CVE-2024-52598 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.59% probability of exploitation.

Which products are affected by CVE-2024-52598?

Affected products include 2fauth.

How do I fix CVE-2024-52598?

Upgrade affected software to a fixed version, for example 2fauth 5.4.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-52598 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo