Rclone Symlink Handling Vulnerability Allows Arbitrary File Write

A vulnerability in Rclone prior to version 1.74.4 allows for arbitrary file writes through unvalidated symlink targets when using the '--links' option. Rclone recreates symlinks as '.rclonelink' text objects and writes them to local destinations without validating the target. This flaw enables an attacker to plant a symlink pointing outside the intended directory, which can then be exploited to overwrite sensitive files, such as SSH keys or shell configuration files, leading to potential code execution.

Impact

Exploitation of this vulnerability allows an attacker to gain unauthorized write access to files on the victim's system, with the potential to execute code if certain files, like SSH authorized keys or shell configuration files, are overwritten.

Reproduction

The vulnerability can be reproduced by uploading a symlink as a '.rclonelink' file to an untrusted remote, ensuring that the symlink points to a location outside the destination directory. When Rclone is run with the '--links' option, it will follow the symlink and write a file through it, bypassing the intended destination and allowing arbitrary file writes on the system.

Remediation

Users can update to Rclone version 1.74.4 or later, where this vulnerability has been fixed. The update is available on the Rclone GitHub releases page.