Path Traversal Vulnerability in rsync: Exploitable via --inc-recursive Option
Summary
ALPINE-CVE-2024-12087: A path traversal vulnerability exists in rsync. Affects rsync versions < 3.4.0-r0. Fixed in 3.4.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
rsync is a widely used utility for efficiently transferring and synchronizing files across computer systems. It is known for its speed and flexibility, allowing users to perform incremental backups and transfers. However, a vulnerability has been identified in rsync that can be exploited when the --inc-recursive option is enabled, which is often the default setting. This vulnerability can lead to unauthorized file writes outside the intended destination directory.
Vulnerability Detail
A path traversal vulnerability exists in rsync, specifically when the --inc-recursive option is enabled. This option allows a server to write files outside of the client's intended destination directory due to improper symlink verification and deduplication checks. A malicious server could exploit this vulnerability to write harmful files to arbitrary locations on the client system, posing a significant security risk.
How To Fix
Minimum fixed version
3.4.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the --inc-recursive option when interacting with untrusted servers. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The identified path traversal vulnerability in rsync poses a significant risk, particularly when the --inc-recursive option is enabled. Users are strongly advised to update to the patched version 3.4.0-r0 or later to mitigate this risk. Until then, avoiding the use of the vulnerable option can serve as a temporary workaround.
See every vulnerability recorded for rsync →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The --inc-recursive option in rsync allows for incremental file transfers, but it can also introduce security risks if not properly managed.
Yes, you can avoid using the --inc-recursive option when connecting to untrusted servers as a temporary measure.
If you cannot update rsync immediately, ensure that you limit the use of the --inc-recursive option and monitor your systems for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
