Path Traversal Vulnerability in rsync Package: CVE-2024-12088
Summary
ALPINE-CVE-2024-12088: A flaw was found in rsync. Affects rsync versions < 3.4.0-r0. Fixed in 3.4.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rsync is a widely used utility for efficiently transferring and synchronizing files between a local and a remote system. It is known for its speed and flexibility, allowing users to copy files over SSH or other protocols while minimizing data transfer by only sending differences between source and destination files. However, a flaw has been identified in its handling of symbolic links when the --safe-links option is enabled, making it susceptible to path traversal attacks.
Vulnerability Detail
A flaw was found in rsync where the client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it when using the --safe-links option. This oversight results in a path traversal vulnerability, which may allow an attacker to write arbitrary files outside the intended directory. The vulnerability is classified under CVE-2024-12088 and has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
3.4.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the --safe-links option when running rsync commands. This will prevent the exploitation of the vulnerability until the package can be updated to the fixed version.
Conclusion
The rsync package has a critical vulnerability (CVE-2024-12088) that can lead to path traversal attacks. Users are strongly advised to update to the patched version to secure their systems. In the meantime, avoiding the use of the --safe-links option can serve as a temporary measure to mitigate the risk.
See every vulnerability recorded for rsync →
FAQ
CVE-2024-12088 is a path traversal vulnerability found in the rsync package that can allow unauthorized file writes outside the intended directory.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
A CVSS score of 7.5 indicates a high severity level, suggesting that the vulnerability poses a significant risk to affected systems.
If an immediate update is not possible, refrain from using the --safe-links option as a temporary workaround to mitigate the risk.
More information about rsync can be found in its official documentation or by visiting the project's website.
References
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
