GHSA-gpw7-77cq-9f72: Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host redirects disclosing SSE-C customer encryption keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/rcloneto a version that resolves this vulnerability.Fixed in 1.75.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Rclone deployments using the b2 backend before v1.75.2 are exposed when they use --b2-download-url. The affected traffic includes B2 account authorization tokens and, where used, SSE-C customer encryption keys.
What does an attacker need to exploit it?
An attacker needs to cause or control an HTTP redirect from a host used through --b2-download-url. A same-host redirect that downgrades HTTPS to HTTP can expose the B2 authorization token; a cross-host redirect can disclose SSE-C keys.
Is a default configuration affected?
The described exposure depends on use of --b2-download-url with the b2 backend. The provided information does not establish that configurations not using this option are affected.
How can I tell whether I may already be affected?
Review Rclone versions and b2 backend configuration for versions before v1.75.2 using --b2-download-url. Review redirect behavior from those download URL hosts, particularly HTTPS-to-HTTP same-host redirects and redirects to different hosts.