Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rclone/rclone | go | <= 1.74.4 | 1.75.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the backend/sftp/sftp.go file of the rclone repository. The root cause is improper handling of special characters in filenames when constructing PowerShell commands for execution on a remote SFTP server. The function quoteOrEscapeShellPath was intended to sanitize filenames to be safely included in a PowerShell command string. However, it only escaped the standard ASCII single quote (') and failed to escape several Unicode 'smart quotes' (‘, ’, ‚, ‛) which PowerShell also interprets as quote delimiters. An attacker could create a file with a name containing one of these smart quotes. When an rclone user performs an operation that triggers a remote hash calculation (like using rclone check), the Object.Hash function is called. This function constructs a PowerShell command to get the file hash, using the vulnerable quoteOrEscapeShellPath function to wrap the filename. Due to the incomplete escaping, the attacker's crafted filename can break out of the quoted string and inject arbitrary PowerShell commands. These commands are then executed on the SFTP server via the Fs.run function with the privileges of the user's SSH account. The patch fixes this by introducing a strings.Replacer called powerShellQuoteEscaper that correctly escapes all five quote characters that PowerShell recognizes, thus preventing the command injection.
quoteOrEscapeShellPathbackend/sftp/sftp.go
Object.Hashbackend/sftp/sftp.go
Fs.runbackend/sftp/sftp.go