CVE-2024-52597 (GCVE-0-2024-52597)
Vulnerability from cvelistv5 – Published: 2024-11-20 14:01 – Updated: 2024-11-20 14:31
VLAI?
Title
2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render
Summary
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim's session and access to their tokens. Version 5.4.1 contains a patch for the issue.
Severity ?
6.1 (Medium)
CWE
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:bubka:2fauth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "2fauth",
"vendor": "bubka",
"versions": [
{
"lessThan": "5.4.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52597",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-20T14:29:40.882595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-20T14:31:57.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "2FAuth",
"vendor": "Bubka",
"versions": [
{
"status": "affected",
"version": "\u003c 5.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim\u0027s session and access to their tokens. Version 5.4.1 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-20T14:01:37.062Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3"
},
{
"name": "https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d"
}
],
"source": {
"advisory": "GHSA-q5p4-6q4v-gqg3",
"discovery": "UNKNOWN"
},
"title": "2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-52597",
"datePublished": "2024-11-20T14:01:37.062Z",
"dateReserved": "2024-11-14T15:05:46.770Z",
"dateUpdated": "2024-11-20T14:31:57.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim\u0027s session and access to their tokens. Version 5.4.1 contains a patch for the issue.\"}, {\"lang\": \"es\", \"value\": \"2FAuth es una aplicaci\\u00f3n web para administrar cuentas de autenticaci\\u00f3n de dos factores (2FA) y generar sus c\\u00f3digos de seguridad. Las versiones anteriores a la 5.4.1 son vulnerables a cross site scripting almacenado debido a encabezados incorrectos en el acceso directo a los SVG cargados. La aplicaci\\u00f3n permite cargar im\\u00e1genes en varios lugares. Uno de los tipos de imagen aceptados es el SVG, que permite la creaci\\u00f3n de secuencias de comandos JS. Por lo tanto, al cargar un SVG malicioso que contiene c\\u00f3digo JS, un atacante que pueda llevar a una v\\u00edctima a la imagen cargada podr\\u00eda comprometer la sesi\\u00f3n de esa v\\u00edctima y el acceso a sus tokens. La versi\\u00f3n 5.4.1 contiene un parche para el problema.\"}]",
"id": "CVE-2024-52597",
"lastModified": "2024-11-21T13:57:24.187",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}]}",
"published": "2024-11-20T14:15:17.967",
"references": "[{\"url\": \"https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3\", \"source\": \"security-advisories@github.com\"}]",
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}, {\"lang\": \"en\", \"value\": \"CWE-80\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-52597\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-11-20T14:15:17.967\",\"lastModified\":\"2025-08-04T16:57:38.327\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim\u0027s session and access to their tokens. Version 5.4.1 contains a patch for the issue.\"},{\"lang\":\"es\",\"value\":\"2FAuth es una aplicaci\u00f3n web para administrar cuentas de autenticaci\u00f3n de dos factores (2FA) y generar sus c\u00f3digos de seguridad. Las versiones anteriores a la 5.4.1 son vulnerables a cross site scripting almacenado debido a encabezados incorrectos en el acceso directo a los SVG cargados. La aplicaci\u00f3n permite cargar im\u00e1genes en varios lugares. Uno de los tipos de imagen aceptados es el SVG, que permite la creaci\u00f3n de secuencias de comandos JS. Por lo tanto, al cargar un SVG malicioso que contiene c\u00f3digo JS, un atacante que pueda llevar a una v\u00edctima a la imagen cargada podr\u00eda comprometer la sesi\u00f3n de esa v\u00edctima y el acceso a sus tokens. La versi\u00f3n 5.4.1 contiene un parche para el problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"},{\"lang\":\"en\",\"value\":\"CWE-80\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.1\",\"matchCriteriaId\":\"93DA0184-91A8-4FB3-ACD4-FA9D13D271FF\"}]}]}],\"references\":[{\"url\":\"https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"title\": \"2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-79\", \"lang\": \"en\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-80\", \"lang\": \"en\", \"description\": \"CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3\"}, {\"name\": \"https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d\"}], \"affected\": [{\"vendor\": \"Bubka\", \"product\": \"2FAuth\", \"versions\": [{\"version\": \"\u003c 5.4.1\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-11-20T14:01:37.062Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim\u0027s session and access to their tokens. Version 5.4.1 contains a patch for the issue.\"}], \"source\": {\"advisory\": \"GHSA-q5p4-6q4v-gqg3\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-52597\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-20T14:29:40.882595Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:bubka:2fauth:*:*:*:*:*:*:*:*\"], \"vendor\": \"bubka\", \"product\": \"2fauth\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.4.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-20T14:31:48.441Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2024-52597\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2024-11-14T15:05:46.770Z\", \"datePublished\": \"2024-11-20T14:01:37.062Z\", \"dateUpdated\": \"2024-11-20T14:31:57.628Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…