Описание
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.
A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary system files, compromising system integrity
Отчет
This is an Important vulnerability in rsync that allows for path traversal. Exploitation requires a malicious sender to utilize the --partial-dir or --backup-dir options and the ability to create or leverage symlinks within the rsync module's file tree. This could lead to arbitrary file writes outside the intended module root.
Меры по смягчению последствий
Disable the rsyncd daemon if it is unused (systemctl disable --now rsyncd), or strictly limit TCP/873 access to trusted clients via firewall rules. Within rsyncd.conf, block the exploit vectors directly by setting refuse options = partial-dir backup-dir and maintain defense-in-depth by enforcing use chroot = yes. Finally, ensure no root- or daemon-owned symlinks point outside your module paths, and avoid using the vulnerable flags when operating as a client against untrusted sources.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rsync | Affected | ||
| Red Hat Enterprise Linux 6 | rsync | Affected | ||
| Red Hat Enterprise Linux 7 | rsync | Affected | ||
| Red Hat Enterprise Linux 8 | rsync | Affected | ||
| Red Hat Enterprise Linux 9 | rsync | Affected | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
8.1 High
CVSS3
Связанные уязвимости
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.
rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
rsync 2.3.3 before 3.5.0contains a path traversal vulnerability that a ...
8.1 High
CVSS3