Summary
Before v1.75.0, rclone could mishandle certain Unicode quote characters in remote SFTP filenames when constructing PowerShell hash commands. If a victim invokes server-side hashing on content from an SFTP server containing an attacker-controlled filename, the filename may break out of the intended path and cause PowerShell statements to run under the victim's SSH account.
Affected context
The vulnerability occurs in rclone's SFTP backend when remote paths are interpolated into PowerShell commands used for server-side hashing. Risk depends on a deployment that uses the affected path-handling logic, invokes server-side hashing, and processes filenames controlled or influenced by an untrusted SFTP user.
Exploit preconditions
- Attack surface: rclone's SFTP backend and its server-side hashing workflow
- Required access: The attacker must be able to create or influence a filename on the SFTP server, while the victim must have access to that server
- Trigger point: Processing the attacker-controlled filename during server-side hash command construction
- Why exploitation is possible: The path-escaping logic handles only the ASCII apostrophe, while PowerShell also recognizes several Unicode single-quote characters as delimiters
Why this happens
The underlying bug is incomplete shell metacharacter escaping when data from an SFTP server is interpolated into a PowerShell command. The escaping routine protects against only one quote representation even though the target shell accepts additional Unicode quote characters as string delimiters. This allows untrusted filename data to alter command structure, mapping to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Potential impact
- PowerShell statements may execute under the victim's SSH account
- The affected host or rclone runtime could be compromised
- Files accessible to the victim account may be read, modified, or deleted
- Credentials, tokens, or other sensitive data may be exposed
- The account could be used for lateral movement or additional system changes
General mitigation guidance
Mitigation generally focuses on preventing untrusted path data from becoming shell syntax.
Common defensive patterns include:
- Prefer direct process or API invocation over shell command construction
- Use structured argument passing and a platform-aware, allowlisted escaping routine when a shell is unavoidable
- Treat remote filenames as untrusted input regardless of the storage provider
- Avoid server-side command execution when client-side hashing or a non-shell provider API is available
- Run synchronization and hashing operations under minimally privileged accounts with restricted filesystem and network access
- Constrain access to remote storage namespaces where filenames can be created or modified
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying string interpolation into PowerShell or other shell commands
- Code review checks for custom escaping functions that cover only ASCII metacharacters
- Tests using Unicode delimiter characters and other shell-significant representations
- Runtime monitoring for unexpected PowerShell child processes, command-line activity, or file access by synchronization accounts
- Policy enforcement requiring structured process APIs and security review for shell execution
Automated code review and security scanning tools may help identify command construction patterns, but should be supplemented with platform-specific tests.
