REDHAT-BUG-2460988: High severity Rclone Rclone vulnerability
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearertokencommand is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rclone RC endpoint operations/fsinfoto a version that resolves this vulnerability.Fixed in 1.73.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2460988?
The severity of REDHAT-BUG-2460988 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2460988?
To fix REDHAT-BUG-2460988, upgrade Rclone to version 1.73.5 or later.
What does REDHAT-BUG-2460988 expose?
REDHAT-BUG-2460988 exposes the RC endpoint `operations/fsinfo` without authentication, allowing unauthorized access.
What versions of Rclone are affected by REDHAT-BUG-2460988?
Rclone versions starting from 1.48.0 up to but not including 1.73.5 are affected by REDHAT-BUG-2460988.
What type of vulnerability is REDHAT-BUG-2460988?
REDHAT-BUG-2460988 is a vulnerability caused by improper authorization handling in Rclone.