Package Instance

CodeIgniter4 allows spoofing of IP address when using proxy
### Impact
This vulnerability may allow attackers to spoof their IP address when your server is behind a reverse proxy.

### Patches
Upgrade to v4.2.11 or later, and configure `Config\App::$proxyIPs`.

### Workarounds
Do not use `$request->getIPAddress()`.

### References
- https://codeigniter4.github.io/userguide/incoming/request.html#CodeIgniter\HTTP\Request::getIPAddress

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)

Missing validation of header name and value in codeigniter4/framework
Lack of proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with `Header` class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application.

Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter
### Withdrawn Advisory
This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5862.

### Original Description
A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter.

Duplicate
This advisory duplicates another.

Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued
### Impact
Setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`.

> **Note**
> This vulnerability does not affect session cookies.

The following code does not issue a cookie with the secure flag even if you set `$secure = true` in `Config\Cookie`.

```php
helper('cookie');

$cookie = [
    'name'  => $name,
    'value' => $value,
];
set_cookie($cookie);
// or
$this->response->setCookie($cookie);
```

### Patches
Upgrade to v4.2.7 or later.

### Workarounds
1. Specify the options explicitly.
   ```php
   helper('cookie');

   $cookie = [
       'name'     => $name,
       'value'    => $value,
       'secure'   => true,
       'httponly' => true,
   ];
   set_cookie($cookie);
   // or
   $this->response->setCookie($cookie);
   ```
2. Use Cookie object.
   ```php
   use CodeIgniter\Cookie\Cookie;

   helper('cookie');

   $cookie = new Cookie($name, $value);
   set_cookie($cookie);
   // or
   $this->response->setCookie($cookie);
   ```

### References
- https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie
- https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter\HTTP\Response::setCookie

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)

Generation of Error Message Containing Sensitive Information
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.

CodeIgniter4 Potential Session Handlers Vulnerability
### Impact
When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2)  a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages).

### Patches
Upgrade to version 4.2.11 or later.

### Workarounds
- Use only one session cookie.

### References
- https://codeigniter4.github.io/userguide/libraries/sessions.html#session-drivers

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)

CodeIgniter4 DoS Vulnerability
A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server.

CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
This vulnerability affects applications that:
* Use the ImageMagick handler for image processing (`imagick` as the image library)
* **AND** either:
* Allow file uploads with user-controlled filenames and process uploaded images using the `resize()` method
* **OR** use the `text()` method with user-controlled text content or options

An attacker can:
* Upload a file with a malicious filename containing shell metacharacters that get executed when the image is processed
* **OR** provide malicious text content or options that get executed when adding text to images