Rsync Arbitrary File Enumeration Vulnerability - CVE-2024-12086
Summary
ALPINE-CVE-2024-12086: A flaw was found in rsync. Affects rsync versions < 3.4.0-r0. Fixed in 3.4.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Rsync is a widely used utility for efficiently transferring and synchronizing files between a local and a remote system. It employs a delta-transfer algorithm, which minimizes data transfer by only sending the differences between source and destination files. This makes it a popular choice for backups and mirroring. However, a recently discovered vulnerability (CVE-2024-12086) exposes rsync to potential security risks, allowing unauthorized access to sensitive information on the client's machine.
Vulnerability Detail
A flaw was found in rsync that could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue arises during the file transfer process when the rsync server sends checksums of local data to the client for comparison. By sending specially crafted checksum values for arbitrary files, an attacker may reconstruct the data of those files byte-by-byte based on the responses from the client. This vulnerability poses a significant risk as it can lead to unauthorized access to sensitive data.
How To Fix
Minimum fixed version
3.4.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the rsync server or disabling the service until the package can be updated. Additionally, ensure that only trusted clients are allowed to connect to the rsync server.
Conclusion
The rsync vulnerability identified as CVE-2024-12086 poses a significant risk by allowing unauthorized access to sensitive data on client machines. It is crucial to update to the patched version 3.4.0-r0 or later to mitigate this risk. Implementing the recommended workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for rsync →
FAQ
CVE-2024-12086 is a vulnerability in the rsync package that allows a server to potentially enumerate the contents of arbitrary files on a client's machine.
If exploited, this vulnerability could allow attackers to access sensitive information from your system, leading to data breaches.
All versions of rsync prior to 3.4.0-r0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 6.8, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
