Rclone Path Traversal Vulnerability in Archive Extraction

A path traversal vulnerability has been identified in Rclone's archive extraction feature, prior to version 1.74.4. The issue allows crafted archive entries to escape the designated extraction prefix, potentially overwriting or creating files in the same bucket or path scope on the destination remote. This vulnerability arises because the extraction process does not properly validate archive entry names, allowing parent path components to be exploited.

Impact

Exploitation of this vulnerability could lead to unauthorized creation or modification of files in the same bucket or path scope on the destination remote, bypassing the intended extraction prefix.

Reproduction

The vulnerability can be reproduced by creating a ZIP archive that includes entries with parent path components, such as '../', and then extracting this archive using Rclone's 'archive extract' command. The extraction should be directed to an S3-style remote destination that includes a prefix. After extraction, the logs will show that the files were written outside the intended prefix, demonstrating the path traversal exploit.

Remediation

Users can upgrade to Rclone version 1.74.4 or later, where this vulnerability has been fixed.