templated/CVE-2026-41179

rclone/CVE-2026-41179/Dockerfile

@@ -0,0 +1,11 @@
+# Explicitly pin vulnerable Rclone release version 1.72.0
+FROM rclone/rclone:1.72.0
+
+# Set working directory inside container
+WORKDIR /data
+
+# Expose RC port
+EXPOSE 5572
+
+# Default command runs the Remote Control Daemon (rcd) without auth
+CMD ["rcd", "--rc-web-gui", "--rc-addr=0.0.0.0:5572", "--rc-no-auth"]

rclone/CVE-2026-41179/README.md

@@ -0,0 +1,53 @@
+# CVE-2026-41179 Lab Environment: Rclone Remote Control (RC) Vulnerability
+
+This repository provides Docker Compose environments to deploy both the **Vulnerable** (`v1.72.0`) and **Patched / Safe** (`v1.73.5`) versions of Rclone running the Remote Control Daemon (`rcd`) for security auditing, defense validation, and testing.
+
+---
+
+## Vulnerability Overview
+
+Starting in Rclone version `1.48.0` and prior to version `1.73.5`, the Remote Control (RC) endpoint `operations/fsinfo` is exposed without enforcing proper authentication (`AuthRequired: true`) and accepts attacker-controlled `fs` input. 
+
+Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate a backend on demand. For specific backends (such as WebDAV), parameters like `bearer_token_command` are executed during backend initialization, allowing single-request unauthenticated local command execution on reachable RC deployments running without global HTTP authentication.
+
+---
+
+## Environment Setup (`docker-compose.yml`)
+
+Save the following content into your `docker-compose.yml` file to run both instances simultaneously on separate ports:
+
+```yaml
+version: '3.8'
+
+services:
+  # Vulnerable Instance (v1.72.0)
+  rclone_vulnerable:
+    image: rclone/rclone:1.72.0
+    container_name: rclone_vulnerable
+    restart: unless-stopped
+    ports:
+      - "5572:5572"
+    volumes:
+      - ./config_vuln:/config/rclone
+      - ./data_vuln:/data
+    command: >
+      rcd 
+      --rc-web-gui 
+      --rc-addr=0.0.0.0:5572 
+      --rc-no-auth
+
+  # Safe / Patched Instance (v1.73.5)
+  rclone_patched:
+    image: rclone/rclone:1.73.5
+    container_name: rclone_patched
+    restart: unless-stopped
+    ports:
+      - "5573:5573"
+    volumes:
+      - ./config_patched:/config/rclone
+      - ./data_patched:/data
+    command: >
+      rcd 
+      --rc-web-gui 
+      --rc-addr=0.0.0.0:5573 
+      --rc-no-auth

rclone/CVE-2026-41179/docker-compose.yml

@@ -0,0 +1,22 @@
+version: '3.8'
+
+services:
+  rclone:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: rclone_vulnerable
+    restart: unless-stopped
+    ports:
+      - "${RCLONE_PORT:-5572}:5572"
+    env_file:
+      - .env
+    volumes:
+      - ./config:/config/rclone
+      - ./cache:/root/.cache/rclone
+      - ./data:/data
+    command: >
+      rcd 
+      --rc-web-gui 
+      --rc-addr=0.0.0.0:5572 
+      --rc-no-auth