Information Disclosure in Rclone WebDAV Backend

Executive Summary

This vulnerability affects the rclone WebDAV backend where custom credential headers set by the operator are leaked to a different host during an HTTP 3xx redirect. The WebDAV backend forwards these headers to the new host when the server responds with a cross-host redirect. Go's standard library only strips well-known sensitive headers like Authorization or Cookie, leaving custom headers such as X-Auth-Token exposed.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for WebDAV requests with custom headers like X-Auth-Token or X-Api-Key being forwarded to unexpected hosts during HTTP 3xx redirects. Use tools like tcpdump or Wireshark to capture and inspect HTTP redirects and header propagation.

Useful 0 Not Useful 0

Impact Analysis

An attacker who controls or influences a redirect can capture exposed headers and replay them against the original WebDAV service, potentially gaining unauthorized access. This could lead to data breaches or unauthorized actions if the credentials have sufficient privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected rclone versions may face compliance violations due to potential data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid using reusable secret headers on WebDAV remotes that may redirect to other hosts. Update rclone to the latest version if a patch becomes available. As a temporary measure, disable WebDAV redirects or configure the server to avoid cross-host redirects.

Useful 0 Not Useful 0