GHSA-8C48-Q9WJ-3W37中危已审查

rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

OSV 1.4.0 · github-reviewed · 修改于 2026-08-06 04:33

发布时间

2026-08-06 04:33

GitHub 审查时间

2026-08-06 04:33

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/08/GHSA-8c48-q9wj-3w37/GHSA-8c48-q9wj-3w37.json

公告说明

1. Summary

A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent authenticated command. A real test server observed the injected DELE command.

The default FTP encoding and the configuration-wizard examples include Ctl and are not vulnerable to the demonstrated filename. A manual custom encoding that omits Ctl/CrLf is mandatory and is reflected as High attack complexity. The credible trust boundary is a lower-trust source namespace feeding a more-privileged FTP destination: if the attacker already has equivalent rights on that destination, the report establishes a bug but no privilege gain. Protocol framing must still be enforced at the command sink because a filename-compatibility encoder is not a safe substitute for command-argument validation.

2. Affected Assets & Attack Surface

Verified rclone revision: a0c09f1381ae93e2a9a33c529d170186c61ad058 (v1.74.0-240-ga0c09f138)
Current-master check: the relevant paths remained present at commit 961266888fe797390c535386f3b3aa46f4853602 on 2026-07-18
rclone FTP encoding: backend/ftp/ftp.go:232-248, 768-785
Encoder masks/conversion: lib/encoder/encoder.go:36-68, 121-152, 1144-1165
FTP command sinks: backend/ftp/ftp.go:1071-1173, 1309-1428
Dependency: github.com/jlaffaye/[email protected]
Dependency command formatting: ftp.go:604-610, with path-bearing callers at ftp.go:893-947, 1010-1026, and 1069-1080
Preconditions: an attacker can create a filename in a source namespace, the victim copies/syncs it to an FTP destination with greater authority, and that destination uses a manually configured encoding that leaves CR/LF raw
Platform note: Unix and some remote backends can supply newline-bearing names; a local Windows source cannot create the demonstrated filename

标识信息

别名 / CVE

CVE-2026-71311

CWE

CWE-93

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-8c48-q9wj-3w37",
  "aliases": [
    "CVE-2026-71311"
  ],
  "details": "## 1. Summary\n\nA valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent authenticated command. A real test server observed the injected `DELE` command.\n\nThe default FTP encoding and the configuration-wizard examples include `Ctl` and are not vulnerable to the demonstrated filename. A manual custom encoding that omits `Ctl`/`CrLf` is mandatory and is reflected as High attack complexity. The credible trust boundary is a lower-trust source namespace feeding a more-privileged FTP destination: if the attacker already has equivalent rights on that destination, the report establishes a bug but no privilege gain. Protocol framing must still be enforced at the command sink because a filename-compatibility encoder is not a safe substitute for command-argument validation.\n\n## 2. Affected Assets & Attack Surface\n\n- Verified rclone revision: `a0c09f1381ae93e2a9a33c529d170186c61ad058` (`v1.74.0-240-ga0c09f138`)\n- Current-master check: the relevant paths remained present at commit `961266888fe797390c535386f3b3aa46f4853602` on 2026-07-18\n- rclone FTP encoding: `backend/ftp/ftp.go:232-248`, `768-785`\n- Encoder masks/conversion: `lib/encoder/encoder.go:36-68`, `121-152`, `1144-1165`\n- FTP command sinks: `backend/ftp/ftp.go:1071-1173`, `1309-1428`\n- Dependency: `github.com/jlaffaye/[email protected]`\n- Dependency command formatting: `ftp.go:604-610`, with path-bearing callers at `ftp.go:893-947`, `1010-1026`, and `1069-1080`\n- Preconditions: an attacker can create a filename in a source namespace, the victim copies/syncs it to an FTP destination with greater authority, and that destination uses a manually configured encoding that leaves CR/LF raw\n- Platform note: Unix and some remote backends can supply newline-bearing names; a local Windows source cannot create the demonstrated filename\n\n## 3. Technical Root Cause Analysis\n\nRclone represents control characters safely in its internal Standard encoding. Immediately before an FTP operation, `FromStandardPath` decodes that representation and applies the configured backend mask. If the mask omits `Ctl`/`CrLf`, raw newlines are restored. The dependency then formats the resulting argument onto a CRLF-delimited control stream through `textproto.Conn.Cmd` without validating it. Reversible filename representation is therefore being used as the only protection for a protocol-command boundary.\n\n## 4. Proof-of-Concept & Evidence\n\nThe source filename was equivalent to:\n\n```text\nvictim\\r\\nDELE other-secret\\r\\nNOOP\n```\n\nWith the default encoding, no raw newline reached the command. With the valid nondefault configuration `encoding = Slash`, `FromStandardPath` restored raw CRLF. During a real FTP path operation, the server parsed `DELE other-secret` as an independent authenticated command. This establishes injection, not merely unsafe serialization. The test did not establish confidentiality impact or operating-system command execution.\n\n## 5. Impact Assessment\n\nInjected commands run with the configured FTP account's permissions. Demonstrated direct impact is deletion of a different path, with corresponding integrity and availability loss inside that account. Other FTP filesystem commands may be reachable, but confidentiality and arbitrary operating-system command execution are not claimed. The privilege-boundary case requires the victim's FTP account to have more authority than the attacker has in the source namespace.\n\n## 6. Remediation Guidance\n\n- Reject CR and LF in every FTP command argument at the lowest command-construction boundary.\n- Apply the check to paths, usernames, passwords, rename arguments, and all other formatted fields.\n- Return an error rather than silently normalizing an unsafe argument.\n- Keep the default encoder protection as defense in depth and reject an FTP encoding configuration that can restore CR/LF.\n- Add end-to-end tests for CR, LF, CRLF, and each path command.",
  "summary": "rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.75.0"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/rclone/rclone",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2026-08-05T20:33:57Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H"
    }
  ],
  "published": "2026-08-05T20:33:57Z",
  "references": [
    {
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37",
      "type": "WEB"
    },
    {
      "url": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c",
      "type": "WEB"
    },
    {
      "url": "https://github.com/rclone/rclone",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-93"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-08-05T20:33:57Z"
  }
}