Missing Authentication for Critical Function in rclone - #VU155817

Vulnerability details

The vulnerability allows a remote attacker to disclose the existence and type of arbitrary paths in the served remote.

The vulnerability exists due to missing authentication in the basicAuth() and MiddlewareAuthCustom() functions in lib/http/middleware.go when handling OPTIONS requests to rclone serve webdav. A remote attacker can send unauthenticated OPTIONS requests for candidate paths and inspect differences in the Allow response header to disclose the existence and type of arbitrary paths in the served remote.

Deployments using --user/--pass, --htpasswd, or --auth-proxy are affected. Exposure is limited to metadata; OPTIONS requests do not expose file contents or directory listings and do not permit writes.

Affected software

Remediation

External References

• https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj

Related Security Bulletins

• Multiple vulnerabilities in rclone