The vulnerability of the RC-server of the cloud synchronization tool Rclone allows a hacker to execute arbitrary code.

The vulnerability of the RC-server of the cloud synchronization tool Rclone relates to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted request to the operations/fsinfo endpoi...

GHSA-25QR-6MPR-F7QX Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

Summary The RC endpoint options/set is exposed without AuthRequired: true, but it can mutate global runtime configuration, including the RC option block itself. An unauthenticated attacker can set rc.NoAuth=true, which disables the authorization gate for many RC methods registered with...