Rclone Infinite Scale TUS Creation Nil-Response Panic Denial of Service

Vulnerability Overview Vulnerability Name: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic Vulnerability Description: During the initial Infinite Scale TUS creation POST, a may be returned. Rclone dereferences the nil response before parsing the error, leading to a crash. The path in production reproduces the crash against a specific endpoint. Security Impact: This vulnerability is deployment-dependent. One-off uploads fail when the endpoint resets, while RC jobs recover the crash in and return a job error. In Infinite Scale volumes or concurrent/multi-worker CLI processes, unrecovered goroutines during an upload lead to process termination. Affected Scope Affected Versions: Fixed Versions: Affected Components: - Verified Rclone Version: (v1.74.0-248-gal08f138138) - Current Main Branch: unchanged in latest commit - Response Assessment: - Create Path: - Unrecovered VFS Caller: - Restricted RC Caller: - Configuration: Infinite Scale volume WebDAV uploads using TUS - Code Trigger: Any pre-response transport fault, including rejection, reset, timeout, DNS/SSL proxy failure, or cancellation - Security Trigger: Malicious/controlled configured endpoint resetting uploads in long-lifecycle or multi-worker processes Remediation Fixed Version: Remediation Measures: - Check before accessing response fields - Propagate transport errors through the existing retry policy and return a normal error upon exhaustion - Rejection, reset, timeout, DNS, TLS, proxy, and cancellation faults exercise the code defect but do not identify remote security attackers - Limit panics to long-lifecycle worker goroutines as a defense-in-depth measure; maintain nil handling as the primary fix Technical Root Cause Analysis switches on before checking, handling the accompanying error when is nil. A nil response is valid after an HTTP transaction failure before the response is parsed. In WebDAV operations, there is no recovery path. Whether the crash is process-fatal depends on the caller. The VFS write path initiates the operation. The occurs in an unrecovered goroutine ( ), while RC jobs wrap their functions in recovery ( ). Proof of Concept and Evidence 1. Configure an actual Infinite Scale volume creation path to a closed local endpoint. 2. Call . 3. POST returns a transport error and no response. 4. dereferences and crashes. Remote endpoints can produce the same state by accepting and resetting the connection before returning an HTTP response. TLS prevents arbitrary response modification but does not prevent a configured endpoint from closing or resetting its own connection. Rejection, DNS, TLS, proxy, and cancellation faults exercise the code defect but do not identify remote security attackers. Impact Assessment In unrecovered CLI or VFS upload goroutines, a panic terminates the Rclone process and releases all managed work. A controlled configured endpoint can repeat the condition when the victim initiates a TUS upload. RC jobs are excluded from process-level impact because their execution boundaries recover panics and log errors. In one-off processes, the incremental security impact against malicious endpoints is limited. Remediation Guidance Check before accessing response fields Propagate transport errors through the existing retry policy and return a normal error upon exhaustion Rejection, reset, timeout, DNS, TLS, proxy, and cancellation faults exercise the code defect but do not identify remote security attackers Limit panics to long-lifecycle worker goroutines as a defense-in-depth measure; maintain nil handling as the primary fix Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVE ID: No known CVE Weaknesses: - CWE-248 - CWE-476 Credits: - Reporter: cyberian2k - Fix Developer: now Publication Date: Last month

Goal Reached Thanks to every supporter — we hit 100%!

Rclone Infinite Scale TUS Creation Nil-Response Panic Denial of Service

More from this source