rclone Package Path Validation Issue: Early Warning
- Severity
- HIGH
- Affected component
- rclone (go)
- Affected versions
- >= 1.40.0, < 1.75.0
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the rclone package. This issue affects versions v1.40 through v1.74.4.
What happened
An early warning has been issued for a critical vulnerability in the rclone package. The issue lies in the incomplete validation of URL paths, which allows an attacker to manipulate paths beginning with `../`. This manipulation can result in the reading, creation, overwriting, or deletion of objects outside the configured path. The affected versions range from v1.40.0 to v1.74.4. This vulnerability is currently under investigation and has not been exploited in the wild.
The rclone package is a command-line program to manage files on cloud storage. The vulnerability affects the Go implementation of rclone. Users of this package within the specified version range should assess their exposure and take appropriate action to mitigate potential risks.
What to do about it
- Upgrade to a version of rclone after v1.74.4 to mitigate the risk.
- Review your application's use of rclone and ensure that it is not exposed to untrusted input that could exploit this vulnerability.
- Monitor the official sources for updates on this vulnerability and any potential patches.
- Consider implementing additional security measures to protect against unauthorized access to your cloud storage.
How 0Day would have caught this
rclone is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using rclone (go) version v1.40.0 or later but before v1.75.0.
What should I do right now?
Upgrade to a version of rclone after v1.74.4 and review your application's use of rclone to ensure it is secure.
Has this been exploited in the wild?
No, this vulnerability has not been reported as exploited in the wild.
Where can I find more information?
Consult the primary source at https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh for the latest information.