Origin validation error in rclone - #VU155819

Vulnerability details

The vulnerability allows a remote attacker to disclose transferred files and substitute downloaded content.

The vulnerability exists due to improper origin validation in the pcloud backend's checkAuth callback handler when processing the callback-supplied hostname parameter. A remote attacker can supply an attacker-controlled API hostname that is persisted in the remote configuration and used for token exchange and subsequent transfers to disclose transferred files and substitute downloaded content.

The documented attack depends on the missing OAuth state check accepting a cross-site callback. A malicious page must be loaded in the victim's browser during rclone config or rclone authorize pcloud.

Affected software

Remediation

External References

• https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46

Related Security Bulletins

• Multiple vulnerabilities in rclone