Skip to main content

Improper Link Resolution Before File Access ('Link Following')

CVE-2024-52522

Medium
5.4/10

Summary

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with `--links` and `--metadata` in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable Privilege Escalation and unauthorized access to critical system files, compromising system Integrity, Confidentiality, and Availability. This vulnerability affects versions 1.59.0 through 1.68.1 and it has been fixed in version 1.68.2.

  • LOW
  • LOCAL
  • ACTIVE
  • LOW

CWE-59 - Improper Link Resolution Before File Access

'Improper link resolution before file access' occurs when software accesses a file resource but fails to verify that the file isn't a link or shortcut to another file. An attacker can potentially gain access to arbitrary files and from there the impact can vary, depending on the application, from sensitive data exposure to remote code execution.

References

Advisory Timeline

  • Published