Fedora Account System
Red Hat Associate
Red Hat Customer
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.
CVSS difference Justification =============================== We believe AC:L should be adjusted to AC:H, as exploitation requires a non-default configuration (rclone rcd --rc-serve) with an unauthenticated, externally reachable RC endpoint. Since these prerequisites are not present in the default configuration, successful exploitation depends on specific deployment conditions, increasing the attack complexity. As a result, we believe the appropriate CVSS score is 8.1 and not 9.8. Additional Pre-conditions can be referred here in this advisory: https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv