Kc1Zs4

The FastCGI transport's `splitPos()` function in `modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go` misuses the `search.IgnoreCase` feature of the `golang.org/x/text/search` library when a request path contains non-ASCII bytes. This leads to two flaws: a control-flow issue where a stale `match` variable allows non-script files to be treated as scripts, and a Unicode equivalence issue where non-ASCII lookalike characters are folded into ASCII characters (e.g., treating `.𝗽𝗵𝗽` as `.php`). In deployments where an attacker can upload or place content into files served via FastCGI, these flaws can be exploited by crafting a specific URL to achieve remote code execution.

A stored Cross-Site Scripting (XSS) issue allows publisher-level accounts to execute arbitrary JavaScript. The problem is caused by a blacklist bypass in the `detectXss()` function, which fails to properly identify HTML event attributes (such as `on*` events) when they are constructed without quotation marks. This allows an attacker to bypass the filter and execute malicious scripts in the browser of any user, including administrators, who views the compromised content, potentially leading to session hijacking or unauthorized actions.

A CRLF injection flaw exists in MimeKit and MailKit when handling SMTP envelope addresses. Specifically, when the local-part of an address is a quoted-string, the software fails to properly prevent the inclusion of carriage return and line feed characters (`r `). This non-compliance with RFC 5321 allows an attacker to inject SMTP commands, such as `RCPT TO`, `DATA`, and `RSET`, or potentially inject mail headers, depending on how the application utilizes MailKit/MimeKit. The issue arises when an attacker can control a `MailboxAddress` value that is subsequently serialized into an SMTP session. The vulnerability is triggered because RFC 5321 prohibits the use of CR and LF characters within quoted-strings. The affected components are MimeKit 4.15.0 and MailKit 4.15.0, and any application that accepts untrusted input for sender/recipient addresses, constructs `MailboxAddress` objects from that input, and sends messages via SMTP may be impacted. Exploitation can lead to mail redirection, data exfiltration, corruption of the SMTP transaction state, and potentially header injection or logging evasion.

The `ToASCII()` and `ToUnicode()` functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For instance, `ToUnicode("xn--example-.com")` returns "example.com" instead of an error. This behavior can lead to privilege escalation in programs using the idna package; a program performing privilege checks on an ASCII hostname might reject "example.com" but permit "xn--example-.com", and subsequently granting access to "example.com" after converting the hostname to Unicode.