CyberRota Analysis
AI-GeneratedRclone versions prior to 1.75.0 are vulnerable to a command injection flaw in the SFTP backend, where improperly handled special characters in filenames can allow an attacker to execute arbitrary PowerShell commands through the victim's SSH account. This vulnerability poses a high risk as it can lead to unauthorized command execution on the server. Organizations using rclone for file synchronization, especially in environments with sensitive data or critical infrastructure, should prioritize upgrading to version 1.75.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.