Rclone Authorization Bypass Vulnerability in Restic Server Allowing Cross-User Repository Access

An authorization bypass vulnerability has been identified in Rclone's Restic server implementation, specifically in versions prior to 1.74.4. The issue arises when the '--private-repos' option is enabled, allowing authenticated users to manipulate URL paths to access, overwrite, or delete files in other users' private repositories. This vulnerability exploits the fact that the authorization check relies on a routed user path segment, while the backend object key is created from the raw, uncleaned URL path. As a result, an authenticated user can craft a request that appears to be authorized but actually targets a different user's repository. The impact of this vulnerability is significant, as it allows for unauthorized access to sensitive repository metadata and objects, potentially leading to data corruption or loss.

Impact

Exploitation of this vulnerability allows authenticated users to bypass the intended isolation between private repositories, enabling them to read, overwrite, or delete files in other users' repositories.

Reproduction

To reproduce this vulnerability, first upload a file to a private repository under one user account. Then, using the same server instance, authenticate as a different user and send a request that includes a '..' traversal in the URL path, targeting the file uploaded by the first user. The request will be processed as if it belongs to the authenticated user, bypassing the authorization check and accessing the victim's file.

Remediation

Users can update to Rclone version 1.74.4 or later, where this vulnerability has been fixed.