GHSA-35g6-9fjv-rmx5: Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads
Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/rcloneto a version that resolves this vulnerability.Fixed in 1.75.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running Rclone from v1.68.0 before v1.75.2 that use serve s3 with the --auth-proxy option are affected. The impact is specifically cross-tenant manipulation and visibility of multipart uploads.
What must an attacker have to exploit the vulnerability?
The attacker must be an authenticated tenant and must know the victim's bucket, object, and multipart upload ID. The attack has high complexity because these identifiers are required.
What can an attacker do with a victim's multipart upload ID?
They can inject parts into, complete, or abort the victim's in-flight multipart upload. They can also view upload and object metadata across tenants.
What should be done if the deployment uses this configuration?
Upgrade Rclone to v1.75.2 or later. Until upgrading, treat multipart upload IDs and the associated bucket and object identifiers as sensitive, since authenticated tenants that obtain them may affect another tenant's uploads.