rclone Local Backend setuid/setgid Privilege Escalation

Executive Summary

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend. Attackers can set setuid or setgid bits on files they control. If rclone runs as root, attackers can create a root-owned setuid binary to escalate privileges to root. If rclone runs as a non-root user, attackers can create a setuid binary owned by that user for lateral privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

Check if your rclone version is 1.74.3 or earlier by running 'rclone version'. If vulnerable, inspect files copied with metadata preservation for unexpected setuid/setgid bits using 'ls -l' or 'find /path -perm /6000'.

Useful 0 Not Useful 0

Impact Analysis

If you use rclone versions 1.74.3 or earlier, an attacker who controls a remote source could plant a malicious setuid binary. If rclone runs as root, this could allow any local user to gain root privileges. Even if rclone runs as a non-root user, the attacker could escalate privileges to that user account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized privilege escalation, potentially violating access control requirements in GDPR and HIPAA. If exploited, it may result in unauthorized data access or modification, compromising compliance with data protection and security standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade rclone to version 1.74.4 or later. Avoid running rclone as root. Disable metadata ownership preservation unless explicitly required. Use '--local-metadata-set-ownership' only when necessary.

Useful 0 Not Useful 0