0Wnerdied

**Name of the Vulnerable Software and Affected Versions** Rclone versions 1.45.0 through 1.73.4 **Description** An authorization bypass exists in the Remote Control (RC) interface of Rclone. The RC endpoint "options/set" is exposed without requiring authentication, allowing an unauthenticated attacker to modify the global runtime configuration. Specifically, an attacker can set the `rc.NoAuth` variable to `true`, which disables the authorization gate for numerous other RC methods that normally require authentication. This occurs on RC servers started without global HTTP authentication that are reachable over the network. This flaw can lead to unauthorized access to sensitive administrative functionality, including configuration and operational methods such as "config/listremotes", "config/dump", "config/get", "operations/list", "operations/copyfile", and "core/command". In certain configurations, this may further enable local file reads, disclosure of credentials and configurations, filesystem enumeration, and remote command execution via the `metadataMapper()` function. **Recommendations** Update to version 1.73.5. Restrict network access to the Remote Control interfaces. Avoid starting the RC server without global HTTP authentication (e.g., ensure the use of `--rc-user`, `--rc-pass`, or `--rc-htpasswd`).

**Name of the Vulnerable Software and Affected Versions** Rclone versions 1.48.0 through 1.73.4 **Description** The RC endpoint "operations/fsinfo" is exposed without authentication and accepts attacker-controlled `fs` input. Since the `rc.GetFs()` function supports inline backend definitions, an unauthenticated attacker can instantiate a backend on demand. Specifically, for the WebDAV backend, the `bearer token command` is executed during initialization, allowing for single-request unauthenticated local command execution on reachable RC deployments that lack global HTTP authentication. **Recommendations** Update to version 1.73.5. As a temporary workaround, restrict access to the "operations/fsinfo" endpoint or enable global RC HTTP authentication using `--rc-user`, `--rc-pass`, or `--rc-htpasswd` to prevent unauthenticated access.

**Name of the Vulnerable Software and Affected Versions** frp versions 0.43.0 through 0.68.0 **Description** An authentication bypass exists in the HTTP vhost routing path when `routeByHTTPUser` is utilized for access control. In proxy-style requests, the routing logic selects the `routeByHTTPUser` backend using the username from the "Proxy-Authorization" header, whereas the access control check validates credentials from the standard "Authorization" header. Consequently, an attacker who can reach the HTTP vhost entrypoint and knows or guesses the protected `routeByHTTPUser` value can access a backend protected by `httpUser` and `httpPassword`, even if the "Proxy-Authorization" password is incorrect. This issue specifically affects deployments that explicitly use `routeByHTTPUser` and does not impact ordinary HTTP proxies. **Recommendations** Update to version 0.68.1. As a temporary workaround, restrict or disable the use of the `routeByHTTPUser` feature.