Listen to this Post
The vulnerability resides in rclone’s WebDAV backend when using the TUS (resumable upload) protocol with ownCloud Infinite Scale. During the initial creation POST request, a transport failure—such as connection refusal, reset, timeout, DNS/TLS/proxy failure, or cancellation—can cause the HTTP client to return a nil response alongside a non-nil error. The function `getTusLocationOrRetry` (backend/webdav/tus.go:45-59) immediately switches on `resp.StatusCode` without first checking whether `resp` is nil. This leads to a nil pointer dereference and a panic. The panic is not recovered within the WebDAV operation itself. The process-wide impact depends on the caller: the VFS write path (vfs/write.go:71-81) starts `operations.Rcat` in an unrecovered goroutine, so the panic terminates the entire rclone process, killing any unrelated uploads or mounts. In contrast, RC jobs (fs/rc/jobs/job.go:107-115) wrap their function in recover, so the panic is contained and returned as a job error. A malicious or compromised endpoint can repeatedly trigger this condition by resetting the connection before returning an HTTP response, causing repeated crashes in long-lived VFS mount or multi-remote CLI processes. TLS does not prevent this because the endpoint controls its own connection behavior. The vulnerability was verified in revision `a0c09f1381ae93e2a9a33c529d170186c61ad058` (v1.74.0-240-ga0c09f138) and the code remained unchanged in master as of 2026-07-18 (commit 961266888fe797390c535386f3b3aa46f4853602). The primary fix is to check `resp == nil` before accessing response fields and to pass transport errors through the existing retry policy.
DailyCVE Form:
Platform: rclone
Version: v1.74.0-240-ga0c09f138
Vulnerability: Nil pointer dereference
Severity: Moderate
date: 2026-07-31
Prediction: 2026-08-15
What Undercode Say:
Reproduce by configuring a closed local endpoint rclone config create ocis webdav vendor infinitescale url https://closed-endpoint.example rclone copy /tmp/test ocis:/ Panic: runtime error: invalid memory address or nil pointer dereference
// Vulnerable code path in backend/webdav/tus.go
func getTusLocationOrRetry(...) (string, error) {
resp, err := req.Do(ctx)
if err != nil {
// resp is nil, but code proceeds to switch on resp.StatusCode
}
switch resp.StatusCode { // panic if resp == nil
...
}
}
Exploit:
- Configure a malicious WebDAV endpoint that accepts the TUS creation POST but resets the connection before sending an HTTP response.
- Initiate any upload to that endpoint using rclone in a long-lived VFS mount or multi-remote CLI process.
- The nil response triggers a panic, terminating the entire rclone process and all unrelated work.
- Repeat the attack whenever the victim initiates a new TUS upload to maintain denial of service.
Protection:
- Upgrade to a patched rclone version once available (check for commits addressing `resp == nil` in
backend/webdav/tus.go). - Avoid using untrusted or compromised Infinite Scale endpoints.
- For long-lived processes, consider running rclone under a supervisor that restarts it automatically.
- Use RC jobs for uploads where possible, as they recover panics and return errors instead of crashing.
Impact:
- Denial of service: in unrecovered CLI or VFS upload goroutines, the panic terminates the rclone process and any unrelated work it hosts.
- A hostile configured endpoint can repeat the condition whenever the victim initiates a TUS upload, causing repeated crashes.
- RC jobs are excluded from process-wide impact because their execution boundary recovers the panic and records an error.
- In a one-shot process dedicated to the hostile endpoint, the incremental security impact over an ordinary transport error is limited.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
