Saku0512

An issue exists in the origin validation mechanism where the `wildcardPatternToRegex` function in `v2/internal/frontend/originvalidator/originValidator.go` incorrectly expands asterisk characters into unrestricted regular-expression matches. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix. This allows an attacker to bypass origin restrictions and invoke bound Go methods through Inter-Process Communication (IPC). The impact depends on the operations exposed by the application's bound methods, potentially leading to unauthorized file system access, database queries, or OS command execution.

An inefficient algorithmic complexity issue exists in the QUIC stream reassembly process. OpenSSL uses a doubly-linked list to manage received QUIC stream fragments; while append operations are optimized, any fragment that does not immediately follow the current `tail` triggers a head-to-tail linear search. A remote peer that has completed the handshake can manipulate the sequence of offsets using compliant STREAM frames within the advertised receive window to force the server into O(n^2) operations. This results in progressive performance deterioration and excessive CPU pressure, potentially leading to a Denial of Service with low attacker bandwidth.

An information disclosure issue exists in the development server's Chrome DevTools workspace endpoint 'GET /.well-known/appspecific/com.chrome.devtools.json'. The local-request gate `isLocalDevRequest()` relies on the Host header instead of the connected peer address. If the development server is bound to a network-reachable interface and `experimental.chromeDevtoolsProjectSettings` is enabled, an unauthenticated attacker on the local network can spoof the Host header to retrieve the project's absolute filesystem root path `rootDir` and a persistent per-project workspace UUID.

The RealIP middleware blindly trusts the first (leftmost) value of the `X-Forwarded-For` HTTP header. This allows a remote attacker to supply a spoofed IP address in the `X-Forwarded-For` header to bypass rate-limiting mechanisms and IP-based access control lists, as well as to forge log entries.

An issue exists where a remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, can bypass client Uniform Resource Identifier (URI) validation. By registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme, the attacker can trigger Cross-Site Scripting (XSS), which is a technique used to inject malicious scripts into web pages. This allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as during the logout flow or within the Admin Console.

The Hook Authentication feature allows administrators to delegate login verification to an external shell command. User-supplied credentials, specifically the `username` and `password` variables, are interpolated into this command string using `os.Expand` without proper sanitization. An unauthenticated remote attacker can inject shell metacharacters into these fields at the login screen, leading to remote code execution (RCE) where the server executes arbitrary OS commands before authentication occurs.

An issue exists in the Kubernetes Gateway provider regarding the `crossProviderNamespaces` allowlist. When `HTTPRoute` rules declare multiple backendRefs (Weighted Round Robin), the system evaluates the allowlist against the target `backendRef.namespace` instead of the namespace of the route itself. This allows an `HTTPRoute` created in a non-allow-listed namespace to reference internal cross-provider `TraefikService` components, such as `api@internal`, `dashboard@internal`, or `rest@internal`, by pointing the `backendRef.namespace` to an allow-listed namespace that has a matching Gateway API `ReferenceGrant`. This results in the exposure of internal Traefik services on the data plane. Exploitation requires the ability to create an accepted `HTTPRoute` and a corresponding `ReferenceGrant` from an allow-listed namespace.

The hook system in File Browser, which executes administrator-defined shell commands during file events such as upload, rename, and delete, is susceptible to OS command injection. The issue occurs in the `Runner.exec()` function within the `runner/runner.go` file, where variable substitution for values like `$FILE` and `$USERNAME` is performed using `os.Expand` without proper sanitization. An authenticated attacker with file write permissions can craft a malicious filename containing shell metacharacters. When the hook fires, the server executes these characters as arbitrary OS commands, leading to Remote Code Execution (RCE). This pattern is exploitable across various hook events, including `before upload`, `after upload`, `before rename`, `after rename`, `before delete`, and `after delete`.