Description (CNA)
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| rclone / rclone | affected 0 before 1.75.0; unaffected 1.75.0 |
CWE
CWE-319
References
- https://github.com/rclone/rclone/security/advisories/GHSA-h4mf-4v27-hggj
- https://www.vulncheck.com/advisories/rclone-before-webdav-credential-exposure-via-https-to-http-redirect
ADP enrichment
No English description supplied.
No references supplied.