Overview
2FAuth accepts image uploads in several places and allows SVG. Uploaded SVGs are served directly, with response headers that let the browser execute any script embedded in the file.
An attacker uploads an SVG containing JavaScript and sends a victim the direct link. The script runs inside the victim's 2FAuth session and can read their accounts and one-time codes. Version 5.4.1 fixes the issue.
Affected products
- 2FAuth before 5.4.1
Disclosure timeline
- 17 Nov 2024
- Bubka releases 2FAuth 5.4.1 with the fix and a default Content Security Policy
- 20 Nov 2024
- GitHub advisory and CVE-2024-52597 published