Rclone 1.64.x < 1.75.1 FTP Auth-Proxy Cross-Session Backend Confusion (CVE-2026-88017)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346827);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/17");

  script_cve_id("CVE-2026-88017");

  script_name(english:"Rclone 1.64.x < 1.75.1 FTP Auth-Proxy Cross-Session Backend Confusion (CVE-2026-88017)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by a cross-session backend confusion vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Rclone installed on the remote host is 1.64.x prior to 1.75.1. It is, therefore,
affected by a cross-session backend confusion vulnerability:

  - The FTP auth-proxy driver stores one obscured password per username in a server-wide map and
    does not bind the credential or the returned VFS to the authenticated FTP session. If two
    accepted credentials use the same username but resolve to different proxy backends, the later
    login overwrites the map entry, and subsequent operations on the first, still-authenticated
    session are re-authorized with the later session's password and execute against the later
    session's backend. A low-privileged user holding a valid auth-proxy credential can therefore
    gain the read, write, and delete authority of another accepted credential sharing the same FTP
    username. (CVE-2026-88017)

Note that Nessus has not tested for this issue but has instead relied only on the application's
self-reported version number.");
  # https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1c7de67b");
  script_set_attribute(attribute:"see_also", value:"https://github.com/rclone/rclone/releases/tag/v1.75.1");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Rclone version 1.75.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-88017");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rclone:rclone");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("rclone_win_installed.nbin", "rclone_macos_installed.nbin", "rclone_nix_installed.nbin");
  script_require_keys("installed_sw/rclone");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'rclone', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '1.64.0', 'fixed_version': '1.75.1'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);