DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-H4MF-4V27-HGGJ: GHSA-H4MF-4V27-HGGJ: WebDAV Credential Disclosure via Same-Host HTTPS-to-HTTP Redirect in rclone

#security #cve #cybersecurity #ghsa

GHSA-H4MF-4V27-HGGJ: WebDAV Credential Disclosure via Same-Host HTTPS-to-HTTP Redirect in rclone

Vulnerability ID: GHSA-H4MF-4V27-HGGJ
CVSS Score: 7.4
Published: 2026-08-05

A protocol downgrade vulnerability in rclone's WebDAV backend allows sensitive credentials, cookies, and authentication headers to be transmitted in cleartext. This occurs when a remote server redirects an HTTPS request to a plaintext HTTP URL on the same host, which the Go HTTP client default behavior permits without checking the protocol transport layer. This report provides a detailed technical analysis of the root cause, exploit mechanics, patch diff, and remediation strategies.

TL;DR

rclone's WebDAV backend leaked sensitive credentials over cleartext HTTP during same-host HTTPS-to-HTTP redirects due to missing protocol scheme validation in its redirection handlers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-319 / CWE-200
  • Attack Vector: Network (Adversary-in-the-Middle)
  • CVSS v3.1: 7.4 (High)
  • Exploit Status: Proof of Concept (PoC) in regression tests
  • KEV Status: Not Listed
  • Remediation: Upgrade to v1.75.0 or disable auth_redirect

Affected Systems

  • rclone WebDAV Backend
  • rclone: < 1.75.0 (Fixed in: 1.75.0)

Code Analysis

Commit: 59b513b

webdav: fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj

Exploit Details

  • GitHub (Integration Tests): The official test suite includes a functional end-to-end regression proof-of-concept showing how standard Go HTTP configurations leak credentials during redirects in rest_test.go.

Mitigation Strategies

  • Upgrade rclone installations to version v1.75.0 or higher
  • Disable the advanced configuration parameter auth_redirect
  • Implement network-level egress filtering to block unexpected plaintext HTTP traffic to known cloud endpoints

Remediation Steps:

  1. Locate all active installations of rclone within the infrastructure.
  2. Execute 'rclone version' to identify vulnerable deployments running versions prior to v1.75.0.
  3. Apply the v1.75.0 upgrade package via the official package manager or by downloading the binary directly from rclone's release archive.
  4. Inspect configuration files (rclone.conf) for WebDAV targets and confirm that 'auth_redirect' is not set to true.
  5. Establish monitoring rules on the perimeter network to inspect any cleartext HTTP headers targeting corporate WebDAV servers.

References

Read the full report for GHSA-H4MF-4V27-HGGJ on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)