{"uuid": "2cacb2cf-fd00-4f92-9b4b-ecb0d770c246", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-gx4c-2hqx-cw2r", "type": "seen", "source": "https://gist.github.com/alon710/8a116e77ebf57ab04c0fd9d4c43203c2", "content": "# GHSA-GX4C-2HQX-CW2R: GHSA-gx4c-2hqx-cw2r: Cleartext Transmission of Sensitive AWS STS Tokens in rclone S3 Backend via Scheme Downgrade Redirects\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/GHSA-GX4C-2HQX-CW2R\n\n## Summary\nA logic vulnerability in the rclone S3 backend implementation allows an unauthenticated adjacent-network attacker to intercept temporary AWS STS credentials. During HTTP redirection handling, the application fails to verify whether a protocol scheme change occurred (such as transitioning from HTTPS to HTTP). If a secure request is redirected to an unencrypted endpoint on the same host, rclone continues to forward the highly sensitive X-Amz-Security-Token header in cleartext.\n\n## TL;DR\nThe rclone S3 backend does not strip the X-Amz-Security-Token header during HTTPS-to-HTTP redirects on the same host, exposing temporary session tokens to cleartext network sniffing by adjacent attackers.\n\n## Technical Details\n\n- **CWE ID**: CWE-319\n- **Attack Vector**: Adjacent Network\n- **CVSS v3.1 Score**: 3.1\n- **Exploit Status**: PoC (Unit Test Only)\n- **KEV Status**: Not Listed\n- **Affected Component**: backend/s3/s3.go\n\n## Affected Systems\n\n- rclone S3 Backend\n- **rclone**: >= 1.74.3, < 1.74.4 (Fixed in: `1.74.4`)\n\n## Mitigation\n\n- Upgrade the rclone client to version v1.74.4 or above.\n- Enforce TLS-only communication at the storage endpoint ingress, disabling port 80 entirely.\n- Implement HTTP Strict Transport Security (HSTS) on S3 storage endpoints.\n\n**Remediation Steps:**\n1. Identify all production nodes running rclone utility versions below 1.74.4.\n2. Replace the binaries with compiled releases from version 1.74.4 or later.\n3. Audit self-hosted S3 proxy configurations (MinIO, Ceph, Nginx) to ensure they reject plaintext HTTP connections rather than redirecting to them.\n4. Minimize the expiration window of temporary AWS STS tokens in client profiles.\n\n## References\n\n- [GHSA-gx4c-2hqx-cw2r Security Advisory](https://github.com/rclone/rclone/security/advisories/GHSA-gx4c-2hqx-cw2r)\n- [rclone Fix Commit 1a28451e](https://github.com/rclone/rclone/commit/1a28451ea6fc8ac1806b0e9923dcb5b3f543f7fa)\n- [rclone v1.74.4 Release Notes](https://github.com/rclone/rclone/releases/tag/v1.74.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-GX4C-2HQX-CW2R) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T08:31:35.547619Z"}