GHSA-hvpr-p4pv-4f46: Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/rcloneto a version that resolves this vulnerability.Fixed in 1.75.2 - Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in 1.75.2
Event History
Frequently Asked Questions
Which installations are affected?
Rclone versions from 1.52.0 through versions before 1.75.2 are affected. The listed software package is bitnami/rclone.
What must happen for exploitation to succeed?
A user must be performing pCloud authorization while a malicious web page sends a request to the localhost OAuth callback on port 53682. The attack relies on the callback accepting a stateless request during authorization.
What could an attacker achieve?
An attacker can plant attacker-controlled tokens and API host settings. Subsequent transfers may then be sent to the attacker-controlled host.
What is the available fix?
Update to Rclone 1.75.2 or later. The affected range ends before version 1.75.2.