rclone S3 Redirect HTTPS to HTTP Token Exposure Vulnerability

Executive Summary

rclone before version 1.74.4 fails to remove the X-Amz-Security-Token header when an S3 redirect changes from HTTPS to HTTP on the same host. This allows attackers to intercept plaintext HTTP traffic and capture AWS STS session tokens sent in request headers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for HTTP redirects from HTTPS on the same host while using rclone with S3 backends. Check if X-Amz-Security-Token headers are transmitted in plaintext during such redirects. Use packet capture tools like tcpdump or Wireshark to inspect headers in HTTP traffic involving rclone S3 operations.

Useful 0 Not Useful 0

Impact Analysis

If you use rclone with AWS S3 and temporary credentials, an attacker could capture your AWS session token during a redirect from HTTPS to HTTP. This could lead to unauthorized access to your AWS resources or data if the token is used maliciously.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements for protecting sensitive data in transit, such as GDPR's encryption mandates or HIPAA's safeguards for protected health information. Exposure of session tokens could lead to unauthorized access, potentially breaching regulatory standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade rclone to version 1.74.4 or later to address the vulnerability. Avoid using S3 endpoints that redirect from HTTPS to HTTP on the same host. If such redirects are unavoidable, configure rclone to reject scheme downgrades or use alternative secure methods for credential transmission.

Useful 0 Not Useful 0