Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/rclone/rclone
  4. ›
  5. CVE-2024-52522

CVE-2024-52522: Rclone has Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata

November 19, 2024

Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files (e.g., /etc/shadow), compromising system integrity, confidentiality, and availability.

For instance, an unprivileged user could set a symlink to a sensitive file within their home directory, waiting for an administrator or automated process (e.g., a cron job running with elevated privileges) to copy their files with rclone using the –links and –metadata options. Upon copying, rclone will incorrectly apply chown and chmod to the symlink’s target file rather than just the symlink itself, resulting in ownership and permission changes on the sensitive file.

References

  • github.com/advisories/GHSA-hrxh-9w67-g4cv
  • github.com/rclone/rclone
  • github.com/rclone/rclone/commit/01ccf204f42b4f68541b16843292439090a2dcf0
  • github.com/rclone/rclone/security/advisories/GHSA-hrxh-9w67-g4cv
  • nvd.nist.gov/vuln/detail/CVE-2024-52522

Code Behaviors & Features

Detect and mitigate CVE-2024-52522 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 1.59.0 before 1.68.2

Fixed versions

  • 1.68.2

Solution

Upgrade to version 1.68.2 or above.

Impact 5.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Learn more about CVSS

Weakness

  • CWE-281: Improper Preservation of Permissions

Source file

go/github.com/rclone/rclone/CVE-2024-52522.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:15 +0000.