rclone Archive Extract Command Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- rclone (go)
- Affected versions
- <= 1.74.3
- Patched version
- 1.74.3
An early warning has been issued regarding a vulnerability in the rclone archive extract command which may allow overwriting of sibling objects in the same bucket or path scope.
What happened
An early warning has been issued for a vulnerability in the rclone archive extract command. This vulnerability reportedly allows the extraction of crafted archives to write files outside the user-selected destination prefix. This can lead to overwriting sibling objects in the same bucket or path scope. The issue is under investigation and no exploitation in the wild has been confirmed at this time.
The vulnerability affects rclone versions up to and including 1.74.3. The recommended action is to upgrade to rclone version 1.74.3 or later to mitigate the risk of path traversal attacks. The primary source for this vulnerability is the GitHub Security Advisory GHSA-4vr5-p2gc-h23p.
What to do about it
- Upgrade rclone to version 1.74.3 or later to mitigate the risk of path traversal attacks.
- Review your use of the rclone archive extract command to ensure that it is not used with untrusted archives.
- Monitor the primary sources for updates on this vulnerability and any further recommended actions.
How 0Day would have caught this
rclone is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using rclone version 1.74.3 or earlier.
What should I do right now?
Upgrade to rclone version 1.74.3 or later.
Is this vulnerability being exploited in the wild?
There is no confirmed exploitation of this vulnerability in the wild at this time.