REDHAT-BUG-2460989: High severity Rclone Rclone vulnerability
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint options/set is exposed without AuthRequired: true, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set rc.NoAuth=true, which disables the authorization gate for many RC methods registered with AuthRequired: true on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in 1.73.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2460989?
The severity of REDHAT-BUG-2460989 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2460989?
To fix REDHAT-BUG-2460989, ensure that the RC endpoint `options/set` requires authentication by updating your Rclone configuration settings.
What is the impact of REDHAT-BUG-2460989?
The impact of REDHAT-BUG-2460989 includes unauthorized changes to global runtime configuration and potential data exposure.
Which versions of Rclone are affected by REDHAT-BUG-2460989?
Rclone versions prior to 1.45.0 are affected by REDHAT-BUG-2460989.
Is there a workaround for REDHAT-BUG-2460989?
A workaround for REDHAT-BUG-2460989 is to restrict access to the Rclone server or enable additional authentication mechanisms.