Horizon Alert
Summary of the vulnerability and why it matters
An unauthenticated attacker can potentially gain unauthorized administrative control over the Rclone command-line program. This vulnerability allows an attacker to disable security measures and execute sensitive commands, impacting the integrity of your data synchronization operations.
- Remote configuration changes are possible.
- Affects Rclone servers started without global HTTP authentication.
- Allows unauthorized access to administrative functions.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this by sending a request to the Rclone RC endpoint `options/set`. This allows them to disable authentication entirely, granting them full administrative control over the Rclone server and its connected cloud storage. They can then access or modify any data or configuration managed by Rclone.
- Targets Rclone servers without global HTTP auth.
- Exploits exposed `options/set` endpoint.
- Requires network access to Rclone RC.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated attackers to disable authentication and gain unauthorized access to Rclone's administrative functions. While Rclone is primarily a command-line tool, its Remote Control (RC) endpoint can be exposed, potentially allowing remote exploitation if not properly secured. Attackers favor vulnerabilities that grant broad administrative control with minimal effort, and this flaw provides just that if the RC endpoint is reachable.
- No widespread public exploit observed.
- RC endpoint requires unauthenticated access.
- Affects versions 1.45.0 to 1.73.4.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize actions to block unauthorized access to Rclone's remote control endpoint by verifying that `rc.NoAuth` is not set to `true` and that global HTTP authentication is enabled for any exposed RC servers. Teams should investigate any instances where `AuthRequired: true` has been bypassed to prevent potential remote configuration manipulation.
- Review Rclone configurations for `rc.NoAuth=true`.
- Upgrade Rclone to version 1.73.5 or later.
- Monitor logs for unauthorized RC endpoint access.
