CyberRota Analysis
AI-GeneratedVersions of rclone from v1.72.0 to v1.74.4 are vulnerable to multiple denial-of-service attacks due to improper validation of superblock and metadata values in the SquashFS parser, which can lead to process crashes or excessive CPU consumption. Attackers can exploit this vulnerability by placing malicious SquashFS images in storage accessed through an rclone :archive: remote, potentially impacting services like SFTP. Organizations using affected rclone versions should prioritize upgrading to v1.75.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata stream). Variants 1 and 2 terminate the rclone process and, via 'rclone serve sftp', can crash the entire SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client must address or descend into the malicious archive object to trigger it.