Arbitrary File Overwrite in rsync
Summary
CVE-2022-29154: An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. Affects rsync across 2 version ranges.
< 0e10163a9d984a8858f7d83b5c7b46889536aa96
< 3.2.4-r0
Fixed in 3.2.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rsync is an open-source utility that provides fast and versatile file synchronization between remote and local systems. It is widely used for backup and mirroring purposes. However, a vulnerability has been discovered in versions prior to 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. This can lead to unauthorized access and potential compromise of sensitive data.
Vulnerability Detail
The vulnerability arises from insufficient validation of file names by the rsync client. While the server chooses which files/directories are sent to the client, the client does not perform adequate validation. As a result, a malicious rsync server or a Man-in-The-Middle attacker can overwrite arbitrary files in the rsync client target directory and its subdirectories. For example, an attacker could overwrite the .ssh/authorized_keys file, potentially granting unauthorized access to the system.
How To Fix
Minimum fixed version
3.2.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can implement a workaround by ensuring that they only connect to trusted rsync servers. By verifying the integrity and authenticity of the server, the risk of connecting to a malicious server can be reduced. Additionally, users can consider implementing additional security measures such as network segmentation and access controls to limit the impact of a potential attack.
Conclusion
The vulnerability in rsync prior to version 3.2.5 allows malicious servers to overwrite arbitrary files on the client's system. To mitigate this risk, it is crucial to upgrade to the latest version of rsync. Additionally, users should exercise caution when connecting to rsync servers and consider implementing additional security measures. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rsync →
FAQ
rsync is an open-source utility that provides fast and versatile file synchronization between remote and local systems. It is commonly used for backup and mirroring purposes.
The vulnerability allows malicious rsync servers or Man-in-The-Middle attackers to overwrite arbitrary files in the rsync client target directory and its subdirectories. This can lead to unauthorized access and potential compromise of sensitive data.
To fix this vulnerability, it is recommended to upgrade to rsync version 3.2.5 or later. This version includes the necessary fixes to properly validate file names and prevent arbitrary file overwrites.
If upgrading to the latest version is not immediately feasible, users can implement a workaround by ensuring that they only connect to trusted rsync servers. By verifying the integrity and authenticity of the server, the risk of connecting to a malicious server can be reduced.
In addition to upgrading rsync and connecting to trusted servers, users can consider implementing network segmentation and access controls to limit the impact of a potential attack.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
