Eurico Nicacio

A flaw in the Dynamic Client Registration feature allows an attacker with a specific token to register a malicious application. By manipulating the registration request, the attacker can map their own profile details to protected fields such as the user ID `sub` or the intended audience `aud`. This enables the generation of signed security tokens that forge identity information, allowing the attacker to impersonate other users or gain unauthorized access to services relying on these tokens for identity verification.

A privilege escalation issue exists in the role-based access control of Rancher Manager. The `inheritedNamespacedRules` field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance. Because this field lacks the privilege-escalation validation applied to other permission-carrying fields of a GlobalRole, a non-administrative user could be granted permissions in downstream clusters that exceed their current privileges through a global role binding.

An interpretation conflict in `hackney url` allows Server Side Request Forgery (SSRF). This occurs when a host is provided as a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. While a caller's allowlist using `uri string:parse/1` and `inet:parse address/1` may not recognize these as IP addresses, hackney still connects to the denoted address. This also affects `Location` targets during redirects. The issue stems from `hackney url:normalize/2` passing decoded values to `inet parse:address/1` as is, while the connect path in `hackney happy:parse address/1` drops surrounding brackets and the resolver ignores trailing dots, allowing these forms to bypass the IP-literal gate. Applications using an IP allowlist to prevent requests to internal addresses, such as loopback or link-local metadata, are susceptible.

Missing authorization in the unit resources download route allows a controller-authenticated principal, such as a unit agent or a user with only login permissions, to read charm resources of any application in any model. This can be achieved via a crafted request naming an arbitrary unit, potentially exposing sensitive data like container-registry credentials.

An unauthenticated remote attacker can set `conn.host` and `conn.port` to values that violate the RFC 3986 host grammar by using the authority of an HTTP/1 absolute-form or authority-form request target. While the software validates the `Host` header and returns a 400 error if it is malformed, the authority within the request target takes precedence per RFC 9112. The function `determine host and port!/4` in `lib/bandit/pipeline.ex` passes this authority to the application without validation. This allows the injection of NUL, DEL, and non-ASCII bytes, invalid IP literals, and ports outside the 1..65535 range. Applications that construct absolute URLs using `conn.host`, such as through `Plug.Conn.request url/1` or Phoenix URL helpers, may emit links with an attacker-controlled authority. For `CONNECT` requests, the unparsed port string is placed in `conn.port`, which may cause `Plug.Conn.request url/1` to raise an error as `Plug.Conn.port number/0` expects an integer.

Forms utilizing FileUpload or ImageUpload elements with a custom `saveToFileMount` configuration store uploaded files in the default storage folder `1:/user upload/` instead of the intended destination. This behavior can result in files being placed in publicly accessible storage despite the configuration of a restricted, non-public storage. Files stored in this manner are served directly, bypassing the access checks typically applied to non-public storages.

The `quote()` function emits a `{ comment }` token starting with `#`, which comments out the remainder of the shell line, including opening quotes of subsequent string tokens. If a subsequent string contains a line terminator (such as ` `, `r`, `U+2028`, or `U+2029`), the comment is terminated, and the remaining part of the string is executed as shell input. Additionally, the `parse()` function generates a comment token when a `#` character appears in the middle of a word. This can lead to issues when callers combine the output of `parse()` with other untrusted strings.

An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection. This can lead to response-queue poisoning, where bytes from one response are attributed to subsequent requests sharing the same connection. The issue occurs because the `chunk size/1` function in `Mint.HTTP1.Parse` stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined. Subsequently, the `decode body/5` function in `Mint.HTTP1` discards all bytes up to the CRLF using `Parse.ignore until crlf/1`. This results in the acceptance of hex digits followed by arbitrary bytes, whereas RFC 9112 only permits chunk extensions introduced by a `;`. Consequently, an RFC-strict intermediary may reject a line that Mint accepts, causing a disagreement on chunk boundaries and the end of the response body.

An Open Redirect issue exists where an attacker can redirect a victim's browser to an arbitrary origin. This occurs because the `redirect/2` function uses `validate local url!/2` to ensure the target is a local path, but it fails to reject ASCII tab, LF, or CR characters. Since browsers strip these characters before parsing the URL, a value like `/<TAB>/example.com` bypasses validation and is interpreted as a scheme-relative URL. The `push patch/2` function is also affected in versions prior to 0.7.0. The issue is triggered when the application passes an externally influenced value as the `:to` parameter, such as a `return to` parameter during sign-in or a navigation target from a `handle event/3` payload.