{"id":"GHSA-8c48-q9wj-3w37","summary":"rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines","details":"## 1. Summary\n\nA valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent authenticated command. A real test server observed the injected `DELE` command.\n\nThe default FTP encoding and the configuration-wizard examples include `Ctl` and are not vulnerable to the demonstrated filename. A manual custom encoding that omits `Ctl`/`CrLf` is mandatory and is reflected as High attack complexity. The credible trust boundary is a lower-trust source namespace feeding a more-privileged FTP destination: if the attacker already has equivalent rights on that destination, the report establishes a bug but no privilege gain. Protocol framing must still be enforced at the command sink because a filename-compatibility encoder is not a safe substitute for command-argument validation.\n\n## 2. Affected Assets & Attack Surface\n\n- Verified rclone revision: `a0c09f1381ae93e2a9a33c529d170186c61ad058` (`v1.74.0-240-ga0c09f138`)\n- Current-master check: the relevant paths remained present at commit `961266888fe797390c535386f3b3aa46f4853602` on 2026-07-18\n- rclone FTP encoding: `backend/ftp/ftp.go:232-248`, `768-785`\n- Encoder masks/conversion: `lib/encoder/encoder.go:36-68`, `121-152`, `1144-1165`\n- FTP command sinks: `backend/ftp/ftp.go:1071-1173`, `1309-1428`\n- Dependency: `github.com/jlaffaye/ftp@v0.2.1-0.20251026020404-6602e981a1bb`\n- Dependency command formatting: `ftp.go:604-610`, with path-bearing callers at `ftp.go:893-947`, `1010-1026`, and `1069-1080`\n- Preconditions: an attacker can create a filename in a source namespace, the victim copies/syncs it to an FTP destination with greater authority, and that destination uses a manually configured encoding that leaves CR/LF raw\n- Platform note: Unix and some remote backends can supply newline-bearing names; a local Windows source cannot create the demonstrated filename\n\n## 3. Technical Root Cause Analysis\n\nRclone represents control characters safely in its internal Standard encoding. Immediately before an FTP operation, `FromStandardPath` decodes that representation and applies the configured backend mask. If the mask omits `Ctl`/`CrLf`, raw newlines are restored. The dependency then formats the resulting argument onto a CRLF-delimited control stream through `textproto.Conn.Cmd` without validating it. Reversible filename representation is therefore being used as the only protection for a protocol-command boundary.\n\n## 4. Proof-of-Concept & Evidence\n\nThe source filename was equivalent to:\n\n```text\nvictim\\r\\nDELE other-secret\\r\\nNOOP\n```\n\nWith the default encoding, no raw newline reached the command. With the valid nondefault configuration `encoding = Slash`, `FromStandardPath` restored raw CRLF. During a real FTP path operation, the server parsed `DELE other-secret` as an independent authenticated command. This establishes injection, not merely unsafe serialization. The test did not establish confidentiality impact or operating-system command execution.\n\n## 5. Impact Assessment\n\nInjected commands run with the configured FTP account's permissions. Demonstrated direct impact is deletion of a different path, with corresponding integrity and availability loss inside that account. Other FTP filesystem commands may be reachable, but confidentiality and arbitrary operating-system command execution are not claimed. The privilege-boundary case requires the victim's FTP account to have more authority than the attacker has in the source namespace.\n\n## 6. Remediation Guidance\n\n- Reject CR and LF in every FTP command argument at the lowest command-construction boundary.\n- Apply the check to paths, usernames, passwords, rename arguments, and all other formatted fields.\n- Return an error rather than silently normalizing an unsafe argument.\n- Keep the default encoder protection as defense in depth and reject an FTP encoding configuration that can restore CR/LF.\n- Add end-to-end tests for CR, LF, CRLF, and each path command.","aliases":["BIT-rclone-2026-71311","CVE-2026-71311","GO-2026-6187"],"modified":"2026-08-18T17:26:17.295318948Z","published":"2026-08-05T20:33:57Z","database_specific":{"cwe_ids":["CWE-93"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-08-05T20:33:57Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"},{"type":"WEB","url":"https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c"},{"type":"PACKAGE","url":"https://github.com/rclone/rclone"},{"type":"WEB","url":"https://github.com/rclone/rclone/releases/tag/v1.75.0"}],"affected":[{"package":{"name":"github.com/rclone/rclone","ecosystem":"Go","purl":"pkg:golang/github.com/rclone/rclone"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.75.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8c48-q9wj-3w37/GHSA-8c48-q9wj-3w37.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H"}]}