2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary URL, whose content will be stored in an image file in the server if it looks like an image. Additionally, the library does some basic validation on the URI, attempting to filter our URIs which do not have an image extension. However, this can be easily bypassed by appending the string `#.svg` to the URI. The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. If not, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues.
References
| Link | Resource |
|---|---|
| https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4j | Exploit Vendor Advisory |
Configurations
History
04 Aug 2025, 15:24
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4j - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:* | |
| CWE | CWE-80 |
|
| First Time |
2fauth 2fauth
2fauth |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
20 Nov 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-20 15:15
Updated : 2025-08-04 15:24
NVD link : CVE-2024-52598
Mitre link : CVE-2024-52598
JSON object : View
Products Affected
2fauth
- 2fauth
CWE
CWE-918
Server-Side Request Forgery (SSRF)