Improper Verification of Cryptographic Signature in rclone - #VU155816

Vulnerability details

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper verification of cryptographic signatures in the gofakes3 signature package used by rclone serve s3 when processing SigV4-authenticated PUT requests. A remote user can add an unsigned x-amz-copy-source header to a valid presigned upload request to disclose sensitive information.

Exploitation requires possession of a presigned PUT URL for an object. The copy operation runs with the signer's authority and can access source objects across buckets within the serving key's reach. When serving a cloud remote, the source can be anything the rclone process can reach.

Affected software

Remediation

External References

• https://github.com/rclone/rclone/security/advisories/GHSA-w3h7-jxxq-vfrp

Related Security Bulletins

• Multiple vulnerabilities in rclone