Path Traversal in rsync via Symlink Manipulation

Executive Summary

This vulnerability affects rsync versions before 3.5.0. When using the --relative mode, a malicious sender can craft paths with symlink components to write files outside the intended destination directory. The make_path() function follows these symlinks without verifying they stay within the destination boundary, enabling arbitrary file writes on the receiver's system.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed rsync version using the command: rsync --version. If the version is 3.4.3 or earlier, the system is vulnerable. Additionally, review rsync logs for transfers using the --relative (-R) option, as this mode is required for exploitation.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access could manipulate directory structures, overwrite critical files, or plant malicious files on your system. This could lead to data corruption, unauthorized code execution, or system compromise. The impact depends on the files the attacker can access and modify.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized file writes or data tampering. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding protected health information. Exploitation could lead to data breaches, unauthorized access, or integrity violations, potentially resulting in regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade rsync to version 3.5.0 or later. Disable the --relative (-R) option in rsync commands if not required. Restrict rsync access to trusted users and systems. Monitor filesystem changes for unauthorized file writes.

Useful 0 Not Useful 0