Alimony

An issue exists in network-capability matching where port-specific `--deny-net` rules (formatted as HOST:PORT or IP:PORT) only match literal host strings, while the resolved-IP check ignores the port. This allows authenticated users to bypass network restrictions and reach blocked internal services by calling `http::*` functions using a hostname that resolves to a denied IP or by using the IP of a denied hostname. This is a server-side request forgery, which occurs when an attacker induces a server-side application to make requests to an unintended location.

Constructed string and indefinite-length ANY decoding repeatedly concatenates fragments onto a growing bytes value. When processing attacker-controlled BER (Basic Encoding Rules) or CER (Canonical Encoding Rules) data containing numerous constructed OCTET STRING or character-string fragments, the system performs quadratic work. Specifically, `OctetStringPayloadDecoder` uses growing header concatenation and `AnyPayloadDecoder.indefLenValueDecoder` uses growing chunk concatenation, repeatedly copying an increasing prefix. This can lead to CPU exhaustion by occupying decoding workers if a sufficiently fragmented value is provided.

The WebSocket reader retains one `bytes` object for each transport read during the reassembly of an incomplete frame. A malicious peer can split a frame into numerous small reads, causing the per-object overhead to significantly exceed the payload bytes permitted by `max msg size`. This can lead to excessive memory consumption or a denial of service for both servers receiving frames from a malicious client and clients receiving frames from a malicious server.

An issue exists in the handling of forwarded-header reads used to derive request host, protocol, hostname, ip, and ips values. When the `trustProxy` setting is configured with a numeric hop-count value, the system fails to properly validate the connecting address. This allows an attacker who can reach the origin directly, bypassing the front-facing proxy, to spoof forwarded request fields. This can lead to host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, as well as host-based routing and cache poisoning.

Stored cross-site scripting occurs during the rendering of audio and video media via the `sourceParsedownElement()` function. The issue arises because the media URL fragment is concatenated without being escaped into rawHtml source elements, which allows attackers to inject arbitrary HTML and JavaScript that executes within the sessions of users viewing the content.

A denial of service issue exists in the `ScriptRange.Multiply` operator. When the left operand is a lazy sequence, the `LoopLimit` is bypassed, allowing attackers to provide templates with array multiplication on lazy sequences. This can result in billions of uncharged iterations, which pins CPU cores and exhausts garbage collection resources, even if `LoopLimit` is configured to 1.

On Unix systems where the shell is explicitly configured to "sh" or true and `/bin/sh` points to BusyBox, the software fails to properly escape tilde (~) characters in assignment contexts. An attacker providing untrusted input to the `escape()` and `escapeAll()` APIs in an assignment prefixed to a command can inject a tilde payload. This can lead to the disclosure of the user's home directory location or alter the directory where a command operates.

An incomplete fix for a route guard bypass allows an unauthenticated attacker to access files protected by a route-based guard. The static file handler failed to canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and delegation to the send layer. By using a non-canonical path form, an attacker can bypass the guarded route to disclose the contents of protected files. This issue specifically affects applications that protect a subtree of the static root with a route-based guard, whereas those using the `allowedPath` option remain unaffected.

Improper handling of URL expansion in `Remote.create()` and `Submodule.add()` allows for the exfiltration of secrets. Attackers can provide URLs containing environment variable tokens that are expanded into the `.git/config` and `.gitmodules` files. These secrets are then transmitted to attacker-controlled hosts during fetch or pull operations.

Nextcloud is an open source content collaboration platform. A missing permissions check allows users to request and read form submissions belonging to other users.