Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.
The RC endpoint named `options/set` is exposed without the `AuthRequired: true` flag, which means it is publicly accessible without authentication. An attacker can send a request to this endpoint setting the option `rc.NoAuth=true`, which causes global disabling of the authorization gateway for all other RC methods registered with `AuthRequired: true`. As a result, after executing this single unauthenticated call, all previously protected RC endpoints become accessible to anyone without authentication. The vulnerability affects RC servers running without global HTTP authentication.
An attacker gains unauthorized access to sensitive administrative functions of the RC server, including the ability to read and modify configuration as well as control Rclone operations (e.g., file synchronization with cloud providers).
Rclone should be updated to version 1.73.5, which includes a fix eliminating this vulnerability. As an additional security measure, until the update is applied, it is recommended to run the RC server with global HTTP authentication enabled (flags `--rc-user` and `--rc-pass` or `--rc-htpasswd`) and to restrict network access to the RC server only to trusted hosts.
Rclone versions 1.45.0 to 1.73.4 (before version 1.73.5) where the RC server is running without global HTTP authentication.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XRclone
APPRclone1.45 – 1.73.5 (excl.)
Related vulnerabilities
Rclone RCD: nieuwierzytelniony command injection przez inline konfigurację zdalną
Rclone: nieuwierzytelnione RCE przez endpoint RC operations/fsinfo
Rclone: ucieczka poza katalog docelowy przez niezweryfikowany symlink
Rclone: path traversal w trybie serve restic --private-repos
An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the passwor...