Rclone 1.70.x < 1.75.1 RC Per-Server Auth-Proxy Bypass (CVE-2026-88044)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346828);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id("CVE-2026-88044");
  script_xref(name:"IAVB", value:"2026-B-0256");

  script_name(english:"Rclone 1.70.x < 1.75.1 RC Per-Server Auth-Proxy Bypass (CVE-2026-88044)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by an authentication bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Rclone installed on the remote host is 1.70.x prior to 1.75.1. It is, therefore,
affected by an authentication bypass vulnerability:

  - The serve/start remote control method accepts protocol options in a per-server proxyOpt object,
    but the FTP and S3 server constructors decide whether proxy authentication is enabled by
    checking the process-global proxy.Opt.AuthProxy instead of the supplied proxyOpt.AuthProxy.
    When the process-global option is empty, the supplied authentication proxy is silently ignored
    and FTP falls back to its fixed-backend mode, whose defaults accept the username anonymous with
    any password, exposing read, write, and delete operations without the authentication the
    operator configured. For S3, an accepted key reaches the fixed filesystem rather than the
    backend the auth proxy would have selected. (CVE-2026-88044)

Note that Nessus has not tested for this issue but has instead relied only on the application's
self-reported version number.");
  # https://github.com/rclone/rclone/security/advisories/GHSA-p569-5gjg-9cmj
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cefc3678");
  script_set_attribute(attribute:"see_also", value:"https://github.com/rclone/rclone/releases/tag/v1.75.1");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Rclone version 1.75.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-88044");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rclone:rclone");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("rclone_win_installed.nbin", "rclone_macos_installed.nbin", "rclone_nix_installed.nbin");
  script_require_keys("installed_sw/rclone");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'rclone', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '1.70.0', 'fixed_version': '1.75.1'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);