CVE-2024-52522

What it actually does

Insecure handling of symlinks when using --links and --metadata flags during local disk copies allows unprivileged users to cause a subsequent privileged copy operation to alter ownership and permissions on arbitrary symlink target files.

Why it matters to the business

Attackers with local access can achieve privilege escalation and unauthorized modification of critical system files, potentially leading to loss of system integrity, confidentiality, and availability; low EPSS and absence from KEV indicate limited observed exploitation but still requires prompt patching given the privilege-escalation family.

How an attack unfolds

An attacker creates specially crafted symlinks on the local filesystem, then waits for or induces a privileged user or process to run rclone copy with --links and --metadata flags targeting those paths, resulting in the privileged operation modifying ownership or permissions on the symlink targets.

How to fix it

Upgrade rclone to version 1.68.2 or later; for the rclone/rclone GIT package apply commit f2d16ab4c5856098abe9e194c5f4dde6bfc56b66; for glance on Ubuntu 16.04 LTS ensure package version 2:12.0.0-0ubuntu2 or newer is installed.

How to confirm the fix worked

Verify the installed rclone or glance package version matches or exceeds the listed fixed versions; test that symlink targets no longer have their ownership or permissions altered when --links and --metadata are used during privileged copies.

Typical attack path

1. Create malicious symlinks pointing to sensitive files
2. Position the symlinks in a location that will be traversed during a future copy operation
3. Wait for or trigger a privileged rclone invocation using --links and --metadata
4. Observe or leverage the resulting permission/ownership changes on target files

How to detect it

Review process execution logs and command-line histories for rclone invocations containing both --links and --metadata flags; correlate with subsequent unexpected changes to file ownership or permissions on system paths.

What your security team should do

• Immediately upgrade all rclone installations to the fixed versions listed
• Audit systems for use of rclone with --links and --metadata flags in automated or privileged scripts
• Restrict local symlink creation permissions where feasible until patching is complete
• Monitor EPSS trend and threat actor activity for any future increase in exploitation likelihood