CVE-2024-52598: 2FAuth Server-Side Request Forgery in Account Icon Preview

2FAuth is a self-hosted web app for managing two-factor authentication accounts. The POST /api/v1/twofaccounts/preview endpoint fetches a remote image to use as an account icon. The server follows whatever URL it is given, and the image-extension check is defeated by appending #.svg to the URL.

An attacker makes the 2FAuth server request any URL it can reach, including internal services and cloud metadata endpoints. When the response is text, the server saves it as an image file and returns it to the attacker. When it is not, the request still fires blind. Version 5.4.1 fixes both the SSRF and the validation bypass.