Cross-site request forgery in rclone - #VU155818

Vulnerability details

The vulnerability allows a remote attacker to disclose transferred files and substitute downloaded content.

The vulnerability exists due to missing cross-site request forgery protection in the pcloud backend's localhost OAuth callback when processing authorization callbacks without a state parameter. A remote attacker can send a cross-site callback containing an attacker-supplied authorization code and API hostname, leveraging the callback's trust in that hostname to disclose transferred files and substitute downloaded content.

A malicious page must be loaded in the victim's browser while the victim is running rclone config or rclone authorize pcloud. The callback server listens on 127.0.0.1:53682.

Affected software

Remediation

External References

• https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46

Related Security Bulletins

• Multiple vulnerabilities in rclone