rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

1. Summary

A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent authenticated command. A real test server observed the injected DELE command.

The default FTP encoding and the configuration-wizard examples include Ctl and are not vulnerable to the demonstrated filename. A manual custom encoding that omits Ctl/CrLf is mandatory and is reflected as High attack complexity. The credible trust boundary is a lower-trust source namespace feeding a more-privileged FTP destination: if the attacker already has equivalent rights on that destination, the report establishes a bug but no privilege gain. Protocol framing must still be enforced at the command sink because a filename-compatibility encoder is not a safe substitute for command-argument validation.

2. Affected Assets & Attack Surface

• Verified rclone revision: a0c09f1381ae93e2a9a33c529d170186c61ad058 (v1.74.0-240-ga0c09f138)
• Current-master check: the relevant paths remained present at commit 961266888fe797390c535386f3b3aa46f4853602 on 2026-07-18
• rclone FTP encoding: backend/ftp/ftp.go:232-248, 768-785
• Encoder masks/conversion: lib/encoder/encoder.go:36-68, 121-152, 1144-1165
• FTP command sinks: backend/ftp/ftp.go:1071-1173, 1309-1428
• Dependency: github.com/jlaffaye/[email protected]
• Dependency command formatting: ftp.go:604-610, with path-bearing callers at ftp.go:893-947, 1010-1026, and 1069-1080
• Preconditions: an attacker can create a filename in a source namespace, the victim copies/syncs it to an FTP destination with greater authority, and that destination uses a manually configured encoding that leaves CR/LF raw
• Platform note: Unix and some remote backends can supply newline-bearing names; a local Windows source cannot create the demonstrated filename

3. Technical Root Cause Analysis

Rclone represents control characters safely in its internal Standard encoding. Immediately before an FTP operation, FromStandardPath decodes that representation and applies the configured backend mask. If the mask omits Ctl/CrLf, raw newlines are restored. The dependency then formats the resulting argument onto a CRLF-delimited control stream through without validating it. Reversible filename representation is therefore being used as the only protection for a protocol-command boundary.