rclone vulnerabilities

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root.

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes.

Rclone versions 1.46.0 through 1.74.2 have a vulnerability in server mode (rcd --rc-serve) that allows unauthenticated GET and HEAD requests to execute arbitrary system commands. An attacker can craft a URL containing remote storage configuration that executes local commands during initialization.

In Rclone from version 1.48.0 to 1.73.4, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. An unauthenticated attacker can exploit this to execute arbitrary local commands on the server via the WebDAV backend, which runs `bearer_token_command` during initialization.

In Rclone, the RC endpoint `options/set` is exposed without `AuthRequired: true`, allowing modification of global runtime configuration. An unauthenticated attacker can set `rc.NoAuth=true`, disabling the authorization gate for many RC methods that normally require authentication, leading to unauthorized access to sensitive administrative functionality.

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.

rclone serve s3 before version 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like '../root-secret.txt' to escape the bucket namespace and access files in the serve root directory.

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.

rclone before version 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.

rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata stream). Variants 1 and 2 terminate the rclone process and, via 'rclone serve sftp', can crash the entire SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client must address or descend into the malicious archive object to trigger it.

rclone before version 1.75.0 has a vulnerability in the local backend that allows an attacker-controlled source object to create or overwrite files outside the configured destination directory. This occurs when the local destination uses certain filename encodings that can decode a '..' component into an actual parent directory.

rclone, a command-line program for syncing files with cloud storage, has a vulnerability where SFTP paths are interpolated into PowerShell commands, allowing an attacker-controlled filename to execute arbitrary PowerShell statements as the victim SSH account. Affects versions prior to 1.75.0; fixed in 1.75.0.

rclone before version 1.75.0 has a vulnerability in the FTP backend that allows injection of an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This occurs when a filename contains CR/LF characters that are not rejected by the FTP library.

rclone before version 1.75.0 has a vulnerability in the HTTP CONNECT helper that allows a malicious or compromised proxy to cause excessive memory consumption by sending oversized headers, potentially crashing the rclone process. The vulnerability affects FTP and SFTP proxy connections.

rclone serve restic fails to properly reject URL paths beginning with ../, allowing an attacker with REST endpoint access to read, create, overwrite, or delete objects outside the configured directory. Affects versions from 1.40.0 to 1.75.0; fixed in 1.75.0.

In Rclone before version 1.74.4, a vulnerability exists in the `rclone serve restic --private-repos` component. The authorization mechanism uses the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include `..` in a request (e.g., `//..//config`) and read, overwrite, or delete another user's private repository on backends that clean path components.

Rclone before version 1.74.4 has a vulnerability in the archive extract function that allows extracted files to be written outside the user-selected destination directory when extracting a crafted archive containing parent path components (e.g., ../). This allows creation or overwrite of sibling objects in the same bucket or path scope.

In Rclone prior to version 1.74.4, when using the -l/--links flag, symlinks are serialized as .rclonelink text objects and recreated on a local destination without validating the target. This allows an attacker-controlled remote to plant an escaping symlink and cause a subsequent object write to land outside the destination with attacker-chosen contents.