Описание
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.
A flaw was found in rclone. This vulnerability, known as Zip Slip, allows a remote attacker to write arbitrary files outside of the intended destination when processing a specially crafted ZIP archive. By manipulating archive entry names, an attacker can bypass path sanitization, leading to potential system compromise or data integrity issues on affected systems.
Отчет
Exploitation requires the victim to run rclone copy, sync, or mount against an attacker-supplied ZIP archive, and the resulting write is bounded by whatever confinement the destination backend enforces independently of rclone. Red Hat's CVSS score (5.9, CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) rates Privileges Required as Low rather than None (upstream/CVEOrg, 6.3); all other metrics and the Moderate severity match. The PR:L reflects that the archive must already be locally reachable by that rclone invocation, rather than delivered as a remote network step.
Меры по смягчению последствий
No viable mitigation exists for this flaw.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat/cryostat-storage-rhel9 | Fix deferred | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
(rclone is a command-line program to sync files and directories to and ...)
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.
rclone is a command-line program to sync files and directories to and ...
rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
EPSS
5.9 Medium
CVSS3