rclone WebDAV TUS DoS via nil response dereference

Executive Summary

rclone before v1.75.0 has a denial of service vulnerability in the WebDAV TUS creation handler. When a transport failure occurs during TUS uploads, the code dereferences a nil response before checking for errors, causing a panic. This terminates unrecovered goroutines and halts unrelated work in long-lived processes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor rclone processes for crashes or panics during WebDAV TUS uploads. Check logs for nil pointer dereference errors or HTTP transport failures. Use tools like tcpdump or Wireshark to inspect network traffic for connection resets during uploads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause rclone processes to crash unexpectedly, disrupting ongoing operations like VFS mounts or multi-remote CLI tasks. A malicious endpoint could repeatedly reset connections to trigger crashes, leading to service interruptions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by terminating rclone processes through nil pointer dereferences during TUS uploads. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA compliance. However, service disruption from process termination could impact availability requirements in these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade rclone to version v1.75.0 or later to address the vulnerability. If upgrading is not immediately possible, avoid using long-lived rclone processes like VFS mounts or multi-remote CLI operations. Implement network monitoring to detect and block malicious endpoints attempting to reset connections.

Useful 0 Not Useful 0