GHSA-jfwf-28xr-xw6q: RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
SummaryThe RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication.PreconditionsPreconditions for this vulnerability are:The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` serverThe remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in useThe rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etcDetailsThe root cause consists of the following pieces:`operations/fsinfo` is not protected with `AuthRequired: true``operations/fsinfo` calls `rc.GetFs(...)` on attacker-controlled input`rc.GetFs(...)` supports inline backend creation through object-valued `fs`WebDAV backend initialization executes `bearer_token_command`Relevant code paths:[`fs/operations/rc.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go)`operations/fsinfo` is registered without `AuthRequired: true``rcFsInfo()` calls `rc.GetFs(ctx, in)`[`fs/rc/cache.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go)`GetFs()` / `GetFsNamed()` can parse an object-valued `fs``getConfigMap()` converts attacker-controlled JSON into a backend config string[`backend/webdav/webdav.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go)`bearer_token_command` is a supported backend option`NewFs(...)` calls `fetchAndSetBearerToken()` when `bearer_token_command` is set`fetchBearerToken()` invokes `exec.Command(...)`This creates a practical single-request unauthenticated command-execution primitive on reachable RC servers without global HTTP authentication.This was alidated on:current `master` as of 2026-04-14: `bf55d5e6d37fd86164a87782191f9e1ffcaafa82`latest public release tested locally: `v1.73.4`This was also validated on a public amd64 Ubuntu host controlled by the tester, using direct host execution (not containerized PoC execution).PoCMinimal single-request form PoCStart a vulnerable RC server:No `--rc-user`, no `--rc-pass`, no `--rc-htpasswd`.Then send a single request:Expected result:HTTP 200 JSON response from `operations/fsinfo``/tmp/rclone_fsinfo_rce_poc_marker` is created on the hostImpactThis is effectively a single-request unauthenticated command-execution vulnerability on reachable RC deployments without global HTTP authentication.In practice, command execution in the rclone process context can lead to higher-impact outcomes such as local file read, file write, or shell access, depending on the deployed environment.Testing performedThis was successfully reproduced:on a local test environmenton a public amd64 Ubuntu host controlled by the testerOn the public host it was confirmed:the unauthenticated `operations/fsinfo` exploit workedcommand execution occurred on the hostthe issue was reproducible through direct host execution
CVSS v4.0: 9.2
CVSS v3.1: 9.8