Listen to this Post
Intro
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go. The `quoteOrEscapeShellPath` function escapes only the ASCII apostrophe (U+0027) by wrapping a path in apostrophes and doubling any internal apostrophe characters. However, Windows PowerShell also treats four Unicode smart quotes—U+2018, U+2019, U+201A, and U+201B—as valid single-quote delimiters. These characters pass through the rclone encoder unescaped.
An attacker who can control a filename on an SFTP remote (e.g., by creating or renaming files) can craft a name containing one of these Unicode smart quotes. This smart quote terminates the intended path literal in the PowerShell command string. The attacker can then append arbitrary PowerShell statements, followed by a comment to neutralize the remainder of the original command. The completed string is sent as shell source through an SSH `exec` request. When server-side hashing is invoked, the injected PowerShell code executes with the privileges of the victim’s SSH account. The security boundary fails because shell syntax is constructed by string concatenation rather than passing data through a non-code channel.
DailyCVE Form
Platform: rclone
Version: < 1.75.0
Vulnerability: OS Command Injection
Severity: High (CVSS 8.0)
date: 2026-08-05
Prediction: 2026-08-05 (fixed in v1.75.0)
What Undercode Say: Analytics
The vulnerability exists in the `quoteOrEscapeShellPath` function (backend/sftp/sftp.go:2071-2090). The function returns:
return "'" + strings.ReplaceAll(shellPath, "'", "''") + "'", nil
Only `U+0027` is escaped. The four Unicode smart quotes (U+2018, U+2019, U+201A, U+201B) are not handled.
Reproduction steps:
- Configure an SFTP remote whose command shell is PowerShell.
2. Enable or autodetect the PowerShell hash command.
- Place a file whose name contains a smart quote followed by a marker-writing statement and PowerShell comment syntax.
- Trigger an rclone operation that calculates the remote hash.
- Observe the marker created with the SSH account’s permissions.
Proof-of-Concept example filename (conceptual):
test' U+2019 ; Set-Content -Path .\marker.txt -Value 'pwned' .txt
Note: Replace `U+2019` with the actual Unicode character ’.
Exploit
An attacker with the ability to create or rename files on an SFTP server can craft a malicious filename. The filename uses only characters permitted by Windows filesystems and does not depend on slash, colon, pipe, or ASCII apostrophe.
When rclone calculates the hash of this file, the `Object.Hash` path (backend/sftp/sftp.go:1988-2067) is invoked. The `Fs.run` function (backend/sftp/sftp.go:1663-1699) executes the PowerShell hash command. The smart quote closes the path literal, and the appended PowerShell code executes.
Example attack string (injected portion):
; Set-Content -Path C:\temp\pwned.txt -Value 'Exploited'
The “ character comments out the remainder of the original command, preventing syntax errors.
Protection
- Upgrade rclone to v1.75.0 or later.
- The fix expands the escape sequence to handle all Unicode single quotation marks recognized by PowerShell.
- Implement strict file naming policies and validate all filenames before upload to SFTP servers.
- Apply network segmentation and privilege separation to limit the impact of successful exploitation.
Impact
Successful exploitation provides arbitrary command execution as the victim’s SSH account. This can permit:
– File theft, modification, and deletion
– Credential access
– Persistence
– Lateral movement allowed by that account
The attacker needs filename-control capability but does not need the victim’s SSH credentials or an interactive shell. The rclone user’s hash operation supplies the execution step. This vulnerability aligns with CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and maps to ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
