Path Traversal Vulnerability in rsync: Improper Symbolic Link Verification
Summary
CVE-2024-12084: A flaw was found in rsync. Affects rsync versions < 3.4.0-r0. Fixed in 3.4.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rsync is a widely used utility for efficiently transferring and synchronizing files across computer systems. It is known for its speed and versatility, allowing users to copy files locally or remotely while minimizing data transfer by using delta encoding. The package is integral to many backup and file synchronization solutions, making its security paramount. This vulnerability specifically affects rsync's handling of symbolic links when the '--safe-links' option is enabled, potentially exposing systems to unauthorized file access.
Vulnerability Detail
A flaw was found in rsync where the '--safe-links' option fails to properly verify if a symbolic link destination contains another symbolic link within it. This oversight leads to a path traversal vulnerability, allowing attackers to write arbitrary files outside the intended directory. The vulnerability arises from inadequate checks on symbolic links, which can be exploited to manipulate file paths and gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
3.4.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the '--safe-links' option until the package is updated to a secure version. This will reduce the risk of exploitation but may expose the system to other risks associated with symbolic links.
Conclusion
The path traversal vulnerability in rsync poses a significant risk due to improper handling of symbolic links. Users are urged to update to the latest patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring better security for your applications.
See every vulnerability recorded for rsync →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
All versions of rsync prior to the patched version 3.2.7-1+deb12u1 for Debian 12 are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could allow attackers to write files outside the intended directory, potentially leading to data loss or unauthorized access to sensitive information.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
