Technical impact
Rclone versions 1.64.0 through 1.75.1 allow unauthenticated attackers to send HTTP OPTIONS requests to the serve WebDAV endpoint. The server responds with an Allow header that reveals which HTTP verbs are accepted for a given path. By sending OPTIONS to many paths and comparing the returned Allow headers, an attacker can discover the existence of files or directories without authenticating, effectively performing namespace enumeration. This disclosure occurs without executing code or escalating privileges, but it exposes sensitive path information that could aid further attacks.
Affected Systems
The vulnerability affects the rclone rclone product before version 1.75.2. Any instances running rclone 1.64.0 up to 1.75.1 that expose the WebDAV serve interface are in risk.
Risk and Exploitability
The CVSS score of 6.9 indicates moderate severity. An attacker with network reach to the WebDAV endpoint can exploit the bypass without authentication, making the attack vector likely remote network. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting no known widespread exploitation reports. However, because the exploitation requires only plain HTTP requests, the vulnerability remains relatively easy to use in environments where WebDAV is exposed to the public or untrusted networks.
