CVE-2024-52597

CVSS V2 None CVSS V3 None

Description

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim's session and access to their tokens. Version 5.4.1 contains a patch for the issue.

Overview

CVE ID
CVE-2024-52597

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-11-20T14:01:37.062Z

Last Modified Date
2024-11-20T14:31:57.628Z

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html
CWE-80	http://cwe.mitre.org/data/definitions/80.html

References

Reference URL	Reference Tags
https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-52597
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52597

History

Created	Old Value	New Value	Data Type	Notes
2024-11-21 13:29:36				Added to TrackCVE