Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability allows an unauthenticated attacker to execute arbitrary commands on systems running the Rclone command-line program. The issue stems from an exposed remote control endpoint that does not require authentication and accepts user-controlled input, enabling the instantiation of attacker-defined storage backends. This could lead to serious compromise if the Rclone remote control is accessible.
- Attacker can run commands on the server.
- Affects Rclone deployments with remote control enabled.
- Requires the remote control interface to be reachable.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this flaw by sending a specially crafted request to the Rclone RC endpoint. This request would trick Rclone into initializing an attacker-controlled WebDAV backend, leading to the execution of a `bearer_token_command`. This allows the attacker to achieve command execution on the underlying system without any authentication.
- Unauthenticated access required.
- RC endpoint targeted.
- Rclone RC interface must be exposed.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated command execution by leveraging the Rclone RC endpoint's ability to instantiate attacker-controlled backends. Attackers may find this appealing due to the critical impact of remote code execution, but exploitation requires the RC interface to be exposed without global HTTP authentication, which is not the default configuration.
- Exploitation requires RC interface exposure.
- No evidence of widespread exploitation.
- Vulnerability patched in 1.73.5.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching all Rclone instances to version 1.73.5 or later to address the unauthenticated command execution vulnerability. If patching is delayed, immediately investigate and block any network traffic targeting the Rclone RC endpoint, especially on externally facing interfaces.
- Upgrade rclone to 1.73.5+.
- Block RC endpoint access.
- Monitor for suspicious RC activity.
