Rclone Manager
Monthly
RClone Manager versions prior to 0.2.7 start their bundled local rclone rcd engine on 127.0.0.1:51900 without authentication and with a wildcard CORS origin, so any web page the user visits while the daemon is running can issue cross-origin requests to that local API using the user's operating-system privileges. An attacker who convinces a user to open a malicious or compromised page can therefore read configured storage credentials and potentially access, modify, upload, or exfiltrate locally stored files and files reachable through the user's configured remotes; the advisory's possible command-execution impact is unconfirmed. Exploitation requires the local engine to be actively running and the user to load attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6); there is no public exploit identified at time of analysis, and the vendor-released patch is 0.2.7.
RClone Manager versions prior to 0.2.7 start their bundled local rclone rcd engine on 127.0.0.1:51900 without authentication and with a wildcard CORS origin, so any web page the user visits while the daemon is running can issue cross-origin requests to that local API using the user's operating-system privileges. An attacker who convinces a user to open a malicious or compromised page can therefore read configured storage credentials and potentially access, modify, upload, or exfiltrate locally stored files and files reachable through the user's configured remotes; the advisory's possible command-execution impact is unconfirmed. Exploitation requires the local engine to be actively running and the user to load attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6); there is no public exploit identified at time of analysis, and the vendor-released patch is 0.2.7.