CVE-2024-52598

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Nov 20, 2024
Updated: Nov 21, 2024
CWE ID 918
CWE ID 79
CWE ID 80

Summary

CVE-2024-52598 is a vulnerability affecting version 5.4.1 of the 2FAuth web application, which is used to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected issues have been identified: a SSRF (Server-Side Request Forgery) and a URI validation bypass. The SSRF vulnerability allows an attacker to force the application to make GET requests to arbitrary URLs, which are then stored as image files on the server if they appear to be images. However, the URI validation can be bypassed by appending the string "#.svg" to the URI. This combination of vulnerabilities enables an attacker to retrieve URIs accessible from the application, as long as their content type is text-based. The vulnerabilities have been patched in version 5.4.1.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share