Iaohkut

يحتوي نظام b2 الخلفي على مشكلة تعرض لبيانات الاعتماد حيث يتم تسريب رمز تفويض الحساب النشط ومفاتيح SSE-C (التشفير من جانب الخادم باستخدام مفاتيح يوفرها العميل) أثناء عمليات إعادة التوجيه عبر HTTP من مضيفات `--b2-download-url`. يمكن للمهاجم التقاط رمز B2 بنص واضح من خلال مراقبة إعادة توجيه خفض مستوى HTTPS-إلى-HTTP على نفس المضيف، أو الحصول على مفاتيح تشفير العميل SSE-C من خلال عمليات إعادة التوجيه عبر مضيفات مختلفة.

The software fails to confine names from server and third-party listing responses to the listed directory. This allows path traversal sequences in object names, where attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root. However, downstream protections in the local backend currently block actual file escape.

A path traversal issue exists in the `rclone serve docker` volume plugin. The `newVolume()` function in `cmd/serve/docker/volume.go` calculates a volume mountpoint using the `name` variable from a Docker VolumeDriver.Create request without verifying that the resulting path remains within the intended root directory. Subsequently, the `checkMountpoint()` function creates this directory using `file.MkdirAll` before mounting. An attacker providing a `name` containing path traversal sequences (e.g., `../../../../../../etc`) can force the privileged rclone process to create a directory and mount a remote filesystem at an arbitrary host path, potentially shadowing or disrupting system directories. Additionally, the `Volume.restoreState()` function lacks similar validation when reloading persisted volume state.

In the `WhitespacePathNormalizer` class within `src/WhitespacePathNormalizer.php`, the `normalizePath()` function uses `preg match()` with the `u` modifier to detect control characters. When a path contains malformed UTF-8 characters, `preg match()` returns `false` instead of `0`. Because the code uses a truthy check, it fails to distinguish between a non-match and an engine error, allowing paths with both malformed UTF-8 and control characters to bypass the `CorruptedPathDetected::forPath()` exception. This allows `Filesystem::write()` to store files with malicious names. Subsequently, `Filesystem::listContents()` can return raw ANSI escape sequences, which may lead to hidden or spoofed terminal file listings when viewed by an administrator.