Rsync Arbitrary File Enumeration Vulnerability
Summary
CVE-2024-12084: A flaw was found in rsync. Affects rsync versions < 3.4.0-r0. Fixed in 3.4.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rsync is a widely used utility for efficiently transferring and synchronizing files between a local and a remote system. It employs a delta-transfer algorithm that minimizes the amount of data sent over the network by only transferring the differences between source and destination files. This makes it particularly useful for backups and mirroring. However, a recently discovered vulnerability allows an attacker to potentially enumerate the contents of arbitrary files on the client's machine during the file transfer process.
Vulnerability Detail
A flaw was found in rsync that could allow a server to enumerate the contents of arbitrary files from the client's machine. This issue arises when files are copied from a client to a server. During this process, the rsync server sends checksums of local data to the client for comparison to determine what data needs to be sent. By sending specially crafted checksum values for arbitrary files, an attacker may reconstruct the data of those files byte-by-byte based on the responses from the client. The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.4.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the rsync service or limit the files that can be synchronized to mitigate the risk of exploitation until a patch is applied.
Conclusion
The rsync arbitrary file enumeration vulnerability poses a risk of data exposure from the client's machine during file transfers. It is crucial to update to the patched version of rsync to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining the security of your systems.
See every vulnerability recorded for rsync →
FAQ
The vulnerability allows an attacker to potentially enumerate and reconstruct the contents of arbitrary files on the client's machine, which could lead to data exposure.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, a patched version of rsync is available. For Debian 12, you should update to version 3.2.7-1+deb12u1 or later.
If immediate updates are not possible, consider restricting access to the rsync service or limiting the files that can be synchronized as a temporary workaround.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
