| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| github.com/rclone/rclone | < 1.74.4 | 1.74.4 |
| rclone | < 1.74.4 | 1.74.4 |
rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive. A malicious archive entry containing parent path components such as ../ can escape the requested extraction prefix and create or overwrite sibling objects in the same bucket/path scope.
The affected code path is in cmd/archive/extract/extract.go.
In ArchiveExtract(), the archive entry path is taken from f.NameInArchive. The code strips only a leading ./ prefix and then joins the archive entry path with the destination directory:
remote := f.NameInArchive
remote = strings.TrimPrefix(remote, "./")
if dstDir != "" {
remote = path.Join(dstDir, remote)
}
_, err = operations.Rcat(ctx, dst, remote, fin, f.ModTime(), nil)
Parent path components such as ../ are not rejected before path.Join() is used.
When the destination is an S3-style remote such as:
:s3:bucket/safe/prefix
rclone creates the destination filesystem rooted at bucket/safe and treats prefix as the destination directory. If the archive contains an entry named:
../escaped-from-prefix.txt
then path.Join("prefix", "../escaped-from-prefix.txt") resolves to:
escaped-from-prefix.txt
As a result, the S3 backend uploads the object to:
bucket/safe/escaped-from-prefix.txt
instead of the expected destination:
bucket/safe/prefix/escaped-from-prefix.txt
This allows an attacker-controlled archive to escape the selected extraction prefix on object-storage remotes.
Test environment:
../escaped-from-prefix.txtSteps to reproduce:https://drive.google.com/file/d/1P_cLKFgiWSVSATB8500yP28jdzwt9FAt/view?usp=sharing
Extract the attached PoC ZIP.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phíRun the PoC script:
powershell -ExecutionPolicy Bypass -File .\run-poc.ps1 -RcloneExe "C:\path\to\rclone.exe"
../escaped-from-prefix.txt
rclone archive extract malicious.zip :s3:bucket/safe/prefix
Expected safe behavior:
PUT /bucket/safe/prefix/escaped-from-prefix.txt
Observed behavior:
PUT /bucket/safe/escaped-from-prefix.txt?x-id=PutObject
This shows that the archive entry escaped the requested safe/prefix destination and was written under safe/ instead.
The PoC package includes:
run-poc.ps1fake-s3-server.pyREADME.mdreport-draft.mdAn attacker who supplies an archive that a victim extracts with rclone archive extract can cause extracted files to be written outside the destination prefix selected by the victim when the destination is an S3-style object storage remote.
Depending on the victim's configured remote credentials and bucket permissions, this may allow creation or overwrite of sibling objects outside the intended extraction directory/prefix.
This does not require compromising the S3 service itself. The attack relies on the victim extracting an attacker-controlled archive with rclone into an object-storage prefix.