Summary
Rclone's WebDAV serving mode contains a path traversal vulnerability that permits unauthenticated attackers to escape the configured served root by supplying an unvalidated parent-directory component.
Successful exploitation may allow attackers to create, overwrite, or delete files belonging to other tenants when the affected service is exposed and shared storage is used.
Rclone's WebDAV serving mode contains a path traversal vulnerability that permits unauthenticated attackers to escape the configured served root by supplying an unvalidated parent-directory component.
Successful exploitation may allow attackers to create, overwrite, or delete files belonging to other tenants when the affected service is exposed and shared storage is used.
Affected context
The issue occurs in Rclone deployments using the WebDAV serving functionality when request paths are not adequately constrained to the configured served root. Risk is higher where the service is reachable without authentication and multiple tenants or storage namespaces share the same underlying filesystem or virtual filesystem.
The issue occurs in Rclone deployments using the WebDAV serving functionality when request paths are not adequately constrained to the configured served root. Risk is higher where the service is reachable without authentication and multiple tenants or storage namespaces share the same underlying filesystem or virtual filesystem.
Exploit preconditions
- Attack surface: Rclone WebDAV request handling
- Required access: Network access to the WebDAV service; authentication may not be required
- Trigger point: A WebDAV request containing a parent-directory path component
- Why exploitation is possible: Path validation permits traversal above the served root, allowing subsequent file operations to address objects outside the intended namespace
- Attack surface: Rclone WebDAV request handling
- Required access: Network access to the WebDAV service; authentication may not be required
- Trigger point: A WebDAV request containing a parent-directory path component
- Why exploitation is possible: Path validation permits traversal above the served root, allowing subsequent file operations to address objects outside the intended namespace
Why this happens
The vulnerability results from insufficient canonicalization and boundary validation of user-controlled WebDAV paths.
When a path containing a parent-directory component is accepted without confirming that its resolved location remains within the configured root, an attacker can escape the intended directory boundary. This is a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') condition.
The vulnerability results from insufficient canonicalization and boundary validation of user-controlled WebDAV paths.
When a path containing a parent-directory component is accepted without confirming that its resolved location remains within the configured root, an attacker can escape the intended directory boundary. This is a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') condition.
Potential impact
- Attackers may create files outside the served root
- Existing files may be overwritten or deleted
- Data belonging to other tenants could be modified or disrupted
- Malicious files may be planted for later execution or processing
- The affected storage service could experience integrity or availability impacts
- Attackers may create files outside the served root
- Existing files may be overwritten or deleted
- Data belonging to other tenants could be modified or disrupted
- Malicious files may be planted for later execution or processing
- The affected storage service could experience integrity or availability impacts
General mitigation guidance
Mitigation generally focuses on enforcing a strict filesystem and tenant boundary for every WebDAV operation.
Common defensive patterns include:
- Canonicalizing requested paths before authorization and filesystem access
- Rejecting parent-directory components and equivalent encoded traversal forms
- Verifying that resolved paths remain beneath the configured served root
- Applying the same boundary checks to create, move, copy, and delete operations
- Separating tenant storage namespaces and reducing shared filesystem access
- Requiring authentication and enforcing least-privilege write permissions
- Using secure-by-default configurations that do not expose writable WebDAV roots unnecessarily
Mitigation generally focuses on enforcing a strict filesystem and tenant boundary for every WebDAV operation.
Common defensive patterns include:
- Canonicalizing requested paths before authorization and filesystem access
- Rejecting parent-directory components and equivalent encoded traversal forms
- Verifying that resolved paths remain beneath the configured served root
- Applying the same boundary checks to create, move, copy, and delete operations
- Separating tenant storage namespaces and reducing shared filesystem access
- Requiring authentication and enforcing least-privilege write permissions
- Using secure-by-default configurations that do not expose writable WebDAV roots unnecessarily
How teams detect issues like this
Organizations can look for path traversal risks through:
- Static analysis of path joins, normalization, and filesystem calls involving request-controlled values
- Code review signals such as authorization checks performed before canonicalization or checks applied only to read operations
- Dynamic testing with normalized, encoded, and alternate parent-directory path representations
- WebDAV access-log monitoring for unusual traversal components and unexpected MKCOL, PUT, MOVE, or COPY activity
- Policy enforcement requiring root-boundary validation and tenant-isolation tests in CI pipelines
Automated security scanning and code review tools may help identify unsafe path handling patterns, but should be supplemented with targeted integration tests.
Organizations can look for path traversal risks through:
- Static analysis of path joins, normalization, and filesystem calls involving request-controlled values
- Code review signals such as authorization checks performed before canonicalization or checks applied only to read operations
- Dynamic testing with normalized, encoded, and alternate parent-directory path representations
- WebDAV access-log monitoring for unusual traversal components and unexpected MKCOL, PUT, MOVE, or COPY activity
- Policy enforcement requiring root-boundary validation and tenant-isolation tests in CI pipelines
Automated security scanning and code review tools may help identify unsafe path handling patterns, but should be supplemented with targeted integration tests.
