Описание
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.
A flaw was found in Rclone, a command-line program for syncing files with cloud storage. When handling symbolic links (symlinks) with the -l or --links option, Rclone serializes them as text objects and recreates them without proper validation. A remote attacker could exploit this by providing a malicious symlink, allowing subsequent file writes to occur outside the intended destination with content chosen by the attacker. This could lead to unauthorized modification of files on the system.
Отчет
Rclone's -l/--links option serializes symbolic links encountered during a sync as .rclonelink text objects containing the link target, and later recreates those links on the destination. Prior to 1.74.4, rclone did not validate that a stored link target stays within the intended destination tree before recreating it. A remote storage backend under an attacker's control can therefore supply a crafted .rclonelink object whose target escapes the destination directory (e.g. via a ../ traversal or an absolute path), causing a subsequent write during the same or a later sync to be redirected outside the intended destination with attacker-chosen content.
Exploitation requires that the victim explicitly enable symlink handling (-l/--links) and initiate a sync against a remote the attacker can influence (e.g. a shared/untrusted cloud storage bucket, or a compromised legitimate remote); it is not exploitable against a default rclone configuration or against a fully trusted remote. This combination of required non-default configuration and required user-initiated action from an untrusted source is reflected in Red Hat's CVSS vector (AC:H, UI:R). The confidentiality impact is limited to what can be inferred from being able to overwrite files (e.g. tampering with a config file that is later read), while the primary impact is to integrity (arbitrary attacker-controlled file content written outside the sync destination) and, secondarily, availability (overwriting or corrupting files outside the destination).
This issue is corrected upstream in rclone 1.74.4, which validates a .rclonelink target stays within the destination before recreating it.
Меры по смягчению последствий
Upgrade to rclone 1.74.4 or later, which validates symlink targets before recreating them and rejects links that would escape the destination directory. If an immediate upgrade is not possible, mitigate by avoiding the vulnerable code path: do not use the -l/--links command-line option when syncing to or from a remote that is not fully trusted, since this is what enables rclone to serialize and recreate symlinks in the first place.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.
Rclone is a command-line program to sync files and directories to and ...
EPSS
7.5 High
CVSS3