CVE-2024-52598: 2FAuth SSRF Vulnerability

CVE-2024-52598 Overview

CVE-2024-52598 affects 2FAuth, a self-hosted web application for managing Two-Factor Authentication (2FA) accounts. Version 5.4.1 contains two interconnected flaws: a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] and a URI validation bypass [CWE-79]. The POST /api/v1/twofaccounts/preview endpoint accepts a remote URI used to fetch a 2FA site icon. Attackers can coerce the application into sending GET requests to arbitrary URLs and retrieve text-based response content stored as an image file on the server.

Critical Impact

Unauthenticated attackers can issue server-side HTTP requests to internal or external endpoints reachable by the 2FAuth host, exposing sensitive text-based content from internal services.

Affected Products

• 2FAuth version 5.4.1
• Self-hosted 2FAuth deployments exposing the preview endpoint
• Deployments with network access to internal services

Discovery Timeline

• 2024-11-20 - CVE-2024-52598 published to NVD
• 2025-08-04 - Last updated in NVD database

Technical Details for CVE-2024-52598

Vulnerability Analysis

The vulnerability resides in the icon preview functionality exposed through POST /api/v1/twofaccounts/preview. The endpoint accepts a user-supplied URI and retrieves its content to use as an icon for a 2FA account entry. The application performs a basic check confirming the URI ends with an image extension. Attackers bypass this filter by appending #.svg to any URI. The fragment identifier is interpreted as part of the path during the extension check but is stripped during the actual HTTP request, so the server fetches the attacker-controlled target without restriction.

When the response is text-based, the content is stored as an image file on the server and becomes retrievable by the attacker. When the response is binary or non-text, the request still executes but the body is not reflected back. This still permits blind SSRF against internal services, cloud metadata endpoints, and other network-reachable resources.

Root Cause

The root cause is improper input validation combined with weak URI parsing. The validator inspects the literal URI string for an image extension rather than parsing the URI structure. Fragment components after # are not stripped before validation, allowing the bypass.

Attack Vector

An attacker submits a crafted JSON body to the preview endpoint containing a URI such as http://169.254.169.254/latest/meta-data#.svg or http://internal-service.local/config#.svg. The application validates the .svg suffix, accepts the URI, and issues an unrestricted GET request. Text-based responses are saved server-side and exposed to the attacker through the resulting image file reference.

No verified public exploit code is available. Refer to the GitHub Security Advisory for technical details.

Detection Methods for CVE-2024-52598

Indicators of Compromise

• Requests to /api/v1/twofaccounts/preview containing URIs with #.svg, #.png, or other fragment-based extensions
• Outbound HTTP requests from the 2FAuth host to internal RFC1918 addresses, link-local 169.254.169.254, or localhost
• Unexpected image files stored in the 2FAuth icon directory containing text, HTML, or JSON content
• Preview API calls referencing non-image hosts such as cloud metadata services or internal admin panels

Detection Strategies

• Inspect web server access logs for POST requests to the preview endpoint and parse the submitted URI for fragment identifiers
• Monitor egress traffic from the 2FAuth server and alert on connections to private IP ranges or metadata IPs
• Scan stored icon files for non-image content signatures and MIME mismatches

Monitoring Recommendations

• Enable application-level logging that records the full request body for the preview endpoint
• Forward 2FAuth and reverse-proxy logs to a centralized SIEM for correlation
• Alert on anomalous request rates against /api/v1/twofaccounts/preview from a single source

How to Mitigate CVE-2024-52598

Immediate Actions Required

• Upgrade 2FAuth to the fixed release published in the vendor advisory
• Restrict outbound network access from the 2FAuth host to deny internal subnets and cloud metadata endpoints
• Place 2FAuth behind authenticated access controls and avoid exposing it directly to the internet
• Audit the icon storage directory for files containing non-image content

Patch Information

The maintainer published an advisory and fix at GHSA-xwxc-w7v3-2p4j. Apply the upgrade referenced in that advisory. Verify the running version after upgrade and re-test the preview endpoint with a fragment-suffixed URI to confirm the bypass is closed.

Workarounds

• Block the /api/v1/twofaccounts/preview endpoint at the reverse proxy if the upgrade cannot be applied immediately
• Apply a web application firewall rule that rejects request bodies containing URI fragments with image extensions
• Configure host-level egress filtering to permit only known external icon CDNs

# Example nginx block for the preview endpoint until patched
location = /api/v1/twofaccounts/preview {
    return 403;
}