2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…2FAuth/security/advisories/GHSA-22mh-gmrh-gpwg Diğer
• github.com/…ommit/52e9db94f2da2a6231d77c49537d6d88ce948ee1 Diğer
• github.com/Bubka/2FAuth/releases/tag/v8.0.0 Diğer

Kayıt geçmişi

1. 6 Kas 2026 23:18Yayımlandı

İlgili açıklar

• 9,8 CVE-2026-634392FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification
• 9,8 CVE-2026-634382FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value
• 4,9 CVE-2026-634412FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets
• 6,5 CVE-2026-634372FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration
• 10,0 CVE-2026-71495Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access
• 6,5 CVE-2026-119758ERPNext OCR 1.1.1 Path Traversal and SSRF via read_document