Cyberlanc3R

**Name of the Vulnerable Software and Affected Versions** rclone versions 1.72.0 through 1.74.4 **Description** Multiple denial-of-service issues exist in the archive backend's SquashFS parser, which utilizes the `github.com/diskfs/go-diskfs` dependency. The parser does not validate attacker-controlled superblock and metadata values. An attacker capable of placing or modifying a SquashFS image in storage exposed via an `rclone :archive:` remote can create a malicious image to trigger an integer division-by-zero panic through a zero block size, an out-of-bounds slice panic via an out-of-range inode metadata offset, or a non-progress CPU loop caused by a truncated metadata stream. The first two scenarios terminate the process and can crash an SFTP server when using `rclone serve sftp`, while the third causes sustained CPU consumption. Because parsing is lazy, the issue is triggered when a victim or remote client accesses or descends into the malicious archive object. **Recommendations** Update rclone to version 1.75.0.

**Name of the Vulnerable Software and Affected Versions** rclone versions prior to 1.75.0 **Description** A denial of service issue exists in the WebDAV TUS creation handler. The problem occurs when the system dereferences a nil response before verifying transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads, triggering a panic. This panic terminates unrecovered goroutines (lightweight threads managed by the Go runtime) and halts unrelated work in long-lived processes. **Recommendations** Update rclone to version 1.75.0 or later.

**Name of the Vulnerable Software and Affected Versions** rclone versions prior to 1.75.0 **Description** The software fails to reject transport downgrades during redirect handling. This allows Basic authorization and Cookie headers to be replayed over plaintext HTTP following same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext communication can capture and reuse these credentials to perform WebDAV operations using the permissions of the compromised account. **Recommendations** Update rclone to version 1.75.0 or later.

**Name of the Vulnerable Software and Affected Versions** rclone versions prior to 1.75.0 **Description** The software fails to sanitize IBM IAM bearer tokens and SSE-C (Server-Side Encryption with Customer-Provided Keys) encryption keys during S3 redirect callbacks. This allows credentials to be preserved when there are changes to the scheme or host. An attacker monitoring network traffic from a trusted endpoint can capture reusable IBM IAM tokens during same-host HTTPS-to-HTTP downgrades or capture SSE-C keys during cross-origin redirects to gain unauthorized access to protected S3 objects. **Recommendations** Update rclone to version 1.75.0 or later.

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** Gitea contains a Server-Side Request Forgery (SSRF) issue where the repository migration process follows HTTP redirects after the initial URL validation. While Gitea validates the user-supplied migration URL against allow/block lists, the actual data transfer is delegated to the Git command-line client. By default, Git follows the first redirect, allowing an attacker to bypass URL policies and redirect the server to internal Git HTTP(S) endpoints. This can lead to the exfiltration of internal Git repositories into an attacker-controlled Gitea repository. The risk is increased when pull mirrors are enabled, as scheduled `git fetch --tags` operations can continue to follow redirects to collect future internal commits. This may expose sensitive data such as CI/CD secrets, cloud credentials, and production configurations. The issue affects the following endpoints: - `POST /repo/migrate` - `POST /api/v1/repos/migrate` **Recommendations** - Disable Git HTTP redirects for migration clone and mirror fetch operations by invoking them with the `-c http.followRedirects=false` configuration. - Enforce egress restrictions for the Gitea process to block outbound access to loopback, RFC1918, and other internal network ranges. - Disable repository migrations and pull mirrors if they are not operationally required. - Restrict migration access to trusted users and disable public self-registration. - Require authentication on all internal Git HTTP endpoints.

**Name of the Vulnerable Software and Affected Versions** view component versions 3.0.0 through 4.8.9 **Description** The system test entrypoint canonicalizes a user-controlled file path using `File.realpath` and verifies if the resolved path starts with the temporary directory path. This containment check is insufficient because sibling directories sharing the same string prefix can bypass the validation. An attacker can use the `file` parameter in the '/ system test entrypoint' endpoint to access and render files located in sibling directories outside the intended temporary directory. This issue is specifically scoped to the test route, which is typically mounted only when the environment is set to test mode. **Recommendations** Update to version 4.9.0. As a temporary workaround, restrict access to the '/ system test entrypoint' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** view component versions 3.0.0 through 4.8.x **Description** The preview route derives an example name from the URL and invokes it using `public send` without verifying if the requested method is an explicitly defined preview example. This allows inherited public methods on `ViewComponent::Preview` to be reachable via routes. Specifically, the `render with template()` function can be accessed, which accepts `template:` and `locals:` parameters. These values can be supplied via request parameters and passed to Rails as `render template:`. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable, potentially exposing secrets, configuration, debug data, or admin-only partials. **Recommendations** Update view component to version 4.9.0. As a temporary workaround, restrict external access to preview routes to minimize the risk of exploitation.