Authentication Bypass in Rclone Serve WebDAV

Executive Summary

Rclone versions 1.64.0 to 1.75.1 have an authentication bypass in the serve webdav feature. Unauthenticated attackers can send OPTIONS requests to skip authentication. By analyzing the Allow header in responses, they can determine if paths, files, or collections exist, enabling namespace enumeration.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your rclone version is between 1.64.0 and 1.75.1. Use the command 'rclone version' to verify. Then, test the WebDAV server by sending an OPTIONS request to a path and checking the Allow header in the response. Example: curl -X OPTIONS http://<server>/<path> -v

If the server responds with an Allow header for unauthenticated OPTIONS requests, it is likely vulnerable. Compare responses for existing and non-existing paths to confirm namespace enumeration.

Useful 0 Not Useful 0

Impact Analysis

Attackers could probe your system to identify accessible paths, files, or directories without authentication. This information could be used for further attacks like unauthorized access or data exfiltration, though file contents are not directly exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements by exposing system structure through namespace enumeration, potentially leading to unauthorized access. GDPR and HIPAA require protecting sensitive data access and integrity, which this flaw undermines by allowing attackers to gather information about system resources.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade rclone to version 1.75.2 or later immediately. If upgrading is not possible, disable the WebDAV server functionality in rclone or restrict access to trusted networks only.

Monitor network traffic for unusual OPTIONS requests targeting WebDAV paths. Consider implementing network-level authentication or firewalls to block unauthorized access.

Useful 0 Not Useful 0