Content spoofing in lookup.nextcloud.com

How it was found

Scenerio An attacker can include any arbitrary text using specially crafted nextcloud url. This is done using character /%0d%0a.

Steps

1. Attacker distributed the below url by means of spamming or through his website https://lookup.nextcloud.com/%0d%0ahas%20moved%20to%20www.evil.com.Please%20visit%20evil.com%20Present%20resource
2. Victim see below text The requested URL / has moved to www.evil.com.Please visit evil.com Present resource was not found on this server.
3. Since the text came from official site so user believes and gets into attacker trap

Resolution Crafted text should not be responded back in the response HTML