rclone (rcd remote control server): An unauthenticated request to the rclone remote-control server instantiates a

Impact

An unauthenticated request to the rclone remote-control server instantiates a backend defined inline in the request, and some backend options run commands. That is unauthenticated arbitrary command execution as whatever user rclone runs as - typically the data-mover service account holding credentials to every storage system it touches.

Who can reach it

Anyone who can reach the rclone rcd HTTP port. Data movers are commonly run on a shared node with the port bound broadly, so a tenant on the same network is enough.

What to do

Upgrade rclone to the fixed release and restart every rcd/serve instance. Treat any exposed instance as compromised and rotate all remote credentials in its config. Bind rcd to loopback, require --rc-user/--rc-pass, and never expose it on a tenant-reachable interface.

References