Server-Side Request Forgery (SSRF) in rclone - #VU155814

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficient restriction of URL authorities in the http backend's named-remote root handling when resolving scheme-relative roots supplied through --rc-serve. A remote attacker can submit a file-serving request containing a crafted named-remote root to direct same-scheme HEAD and GET requests to a selected hostname or IPv4 address and port, receive response bodies, and disclose configured custom headers.

Exploitation requires a reachable listener with --rc-serve enabled, no RC HTTP authentication, --rc-no-auth unset, and knowledge of an existing http remote's name. Header disclosure additionally requires configured custom headers. For HTTPS remotes, the selected endpoint must complete a TLS handshake with a certificate trusted by rclone unless certificate checking is disabled.

Affected software

Remediation

External References

• https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m

Related Security Bulletins

• Multiple vulnerabilities in rclone