Listen to this Post
How GHSA-gwfq-86j8-7qhv Works
The vulnerability exists in the RC (Remote Control) API of rclone, which is a command-line program to sync files and directories to and from different cloud storage providers. When an RC API call triggers a panic that is recovered by the job runner, the full Go stack trace is included in the JSON error response.
The root cause lies in the panic recovery logic within `fs/rc/jobs/job.go` at lines 110-115. The code uses a `defer` function to catch panics:
defer func() {
if r := recover(); r != nil {
j.mu.Lock()
j.EndTime = time.Now()
j.Error = fmt.Sprintf("panic received: %v \n%s", r, string(debug.Stack()))
// ...
}
}()
The `debug.Stack()` function returns the current stack trace as a byte slice, which is then converted to a string and placed directly into the `j.Error` field. This error field is subsequently returned in the HTTP response JSON to the API caller.
An attacker can trigger this behavior by, for example, setting the config path to a non-INI file and then calling the dump endpoint:
curl -s -X POST http://localhost:5572/config/setpath \
-H "Content-Type: application/json" \
-d '{"path":"/etc/hostname"}'
curl -s -X POST http://localhost:5572/config/dump
The response includes a full stack trace with:
- Full filesystem paths (e.g.,
github.com/rclone/rclone/fs/config/config.go:377) - Go module versions (e.g.,
github.com/go-chi/chi/[email protected]) - Go runtime version
- Goroutine IDs and states
- Memory addresses (ASLR leak)
- Partial file contents (the first unparseable line of the target file)
This information disclosure aids in the exploitation of other vulnerabilities by revealing internal architecture, dependency versions (useful for known-CVE targeting), and memory layout.
DailyCVE Form:
Platform: rclone
Version: All with RC API through v1.74.4
Vulnerability: Stack trace disclosure in JSON error
Severity: Low
date: 2026-07-31
Prediction: 2026-08-14
What Undercode Say:
Analytics
The vulnerability is triggered by sending crafted requests to the RC API endpoints. The following commands demonstrate how to reproduce the issue:
Set config path to a non-INI file
curl -s -X POST http://localhost:5572/config/setpath \
-H "Content-Type: application/json" \
-d '{"path":"/etc/hostname"}'
Trigger the dump to get the stack trace
curl -s -X POST http://localhost:5572/config/dump
The response will contain a JSON object with an `”error”` field that includes the full stack trace.
Exploit:
An attacker with network access to an exposed RC API endpoint (running without authentication) can:
1. Send a crafted request that triggers a panic in the RC API
2. Receive the JSON error response containing the full stack trace
3. Extract sensitive information such as:
- Internal file paths and source code locations
- Exact versions of Go modules and dependencies
- Goroutine states and memory addresses
- Partial contents of files that fail parsing
This information can be used to:
- Identify specific vulnerable dependencies for targeted attacks
- Understand the internal architecture and code flow
- Bypass ASLR (Address Space Layout Randomization) by leaking memory addresses
- Read the first line of arbitrary files (as a complementary file read primitive)
Protection:
- Upgrade rclone to a patched version once available
- Apply the remediation by modifying the panic recovery code to:
– Return a generic error message to the API caller
– Log the full stack trace server-side only
– Strip `debug.Stack()` from HTTP responses
3. Restrict network access to the RC API endpoint (port 5572 by default) using firewalls or network policies
4. Enable authentication for the RC API using the `–rc-user` and `–rc-pass` flags
5. Monitor logs for unusual RC API requests that might indicate exploitation attempts
Impact:
Information Disclosure – The vulnerability exposes sensitive internal details to unauthenticated attackers. Stack traces reveal:
– Internal file paths and source code structure
– Go module versions (useful for known-CVE targeting)
– Memory layout and addresses (ASLR bypass)
– Partial file contents (the first line of files that fail INI parsing)
This information can be combined with other vulnerabilities to escalate attacks, such as using the leaked file contents alongside an arbitrary file read vulnerability. The disclosed dependency versions can be used to identify and exploit known vulnerabilities in those specific versions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
