Signature Verification Bypass in rclone Selfupdate

Executive Summary

This vulnerability affects rclone versions 1.55.0 through 1.75.1. It involves a signature verification bypass in the stable self-update mechanism. The software improperly validates archive hashes by searching the entire response, including unsigned prefixes, for the archive hash while only verifying the PGP signature over the clearsigned SHA256SUMS file. An attacker controlling the release distribution path can prepend a fake checksum line matching their malicious archive, bypassing signature validation and causing the self-update to install attacker-controlled code.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check your rclone version with `rclone version`. If it is between 1.55.0 and 1.75.1, it is vulnerable. Additionally, inspect network traffic during self-update attempts for unsigned checksum lines prepended to the SHA256SUMS file.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker to replace the legitimate rclone binary with malicious code during a self-update. This could lead to unauthorized access, data theft, or further compromise of the system where rclone is running. Users running vulnerable versions who execute the selfupdate command without the --check flag are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using vulnerable rclone versions may face legal and regulatory penalties due to potential data exposure or loss of integrity in systems handling sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade rclone to version 1.75.2 or later using `rclone selfupdate --check` to ensure proper signature verification. Avoid running `selfupdate` without the `--check` flag until patched.

Useful 0 Not Useful 0