Path Traversal Vulnerability in rsync: Exploitable via --inc-recursive Option
Summary
CVE-2024-12084: A path traversal vulnerability exists in rsync. Affects rsync versions < 3.4.0-r0. Fixed in 3.4.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
rsync is a widely used utility for efficiently transferring and synchronizing files across systems. It is known for its speed and flexibility, allowing users to perform incremental backups and mirror data. However, its default settings, particularly the --inc-recursive option, can expose users to security risks if not properly managed.
Vulnerability Detail
A path traversal vulnerability exists in rsync due to improper symlink verification when using the --inc-recursive option. This option, which is often enabled by default, allows a malicious server to write files outside of the intended destination directory on the client. The vulnerability arises from deduplication checks that occur on a per-file-list basis, potentially allowing attackers to place malicious files in arbitrary locations on the client system. This could lead to unauthorized access or data corruption.
How To Fix
Minimum fixed version
3.4.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the --inc-recursive option when using rsync or ensure that they are connecting to trusted servers only. Additionally, users should verify symlinks before allowing file transfers.
Conclusion
The path traversal vulnerability in rsync poses a significant risk, particularly when the --inc-recursive option is enabled. Users are advised to update their rsync installations to the latest patched versions and consider workarounds to mitigate potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain security.
See every vulnerability recorded for rsync →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions of rsync prior to 3.2.7-1+deb12u1 for Debian 12 are affected. Debian 11 and 13 are also impacted but do not have a fixed version yet.
If you cannot update rsync immediately, consider disabling the --inc-recursive option and only connect to trusted servers to mitigate the risk.
More information can be found in the CVE database and related advisories such as DLA-4015-1 and DSA-5843-1.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
