rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent authenticated command. A real test server observed the injected DELE command.
The default FTP encoding and the configuration-wizard examples include Ctl and are not vulnerable to the demonstrated filename. A manual custom encoding that omits Ctl/CrLf is mandatory and is reflected as High attack complexity. The credible trust boundary is a lower-trust source namespace feeding a more-privileged FTP destination: if the attacker already has equivalent rights on that destination, the report establishes a bug but no privilege gain. Protocol framing must still be enforced at the command sink because a filename-compatibility encoder is not a safe substitute for command-argument validation.
a0c09f1381ae93e2a9a33c529d170186c61ad058 (v1.74.0-240-ga0c09f138)961266888fe797390c535386f3b3aa46f4853602 on 2026-07-18backend/ftp/ftp.go:232-248, 768-785lib/encoder/encoder.go:36-68, 121-152, 1144-1165backend/ftp/ftp.go:1071-1173, 1309-1428github.com/jlaffaye/ftp@v0.2.1-0.20251026020404-6602e981a1bbftp.go:604-610, with path-bearing callers at ftp.go:893-947, 1010-1026, and 1069-1080Rclone represents control characters safely in its internal Standard encoding. Immediately before an FTP operation, FromStandardPath decodes that representation and applies the configured backend mask. If the mask omits Ctl/CrLf, raw newlines are restored. The dependency then formats the resulting argument onto a CRLF-delimited control stream through textproto.Conn.Cmd without validating it. Reversible filename representation is therefore being used as the only protection for a protocol-command boundary.
The source filename was equivalent to:
victim\r\nDELE other-secret\r\nNOOP
With the default encoding, no raw newline reached the command. With the valid nondefault configuration encoding = Slash, FromStandardPath restored raw CRLF. During a real FTP path operation, the server parsed DELE other-secret as an independent authenticated command. This establishes injection, not merely unsafe serialization. The test did not establish confidentiality impact or operating-system command execution.
Injected commands run with the configured FTP account's permissions. Demonstrated direct impact is deletion of a different path, with corresponding integrity and availability loss inside that account. Other FTP filesystem commands may be reachable, but confidentiality and arbitrary operating-system command execution are not claimed. The privilege-boundary case requires the victim's FTP account to have more authority than the attacker has in the source namespace.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.