rsync Filter Rule Bypass via Malicious Merge Directives

Executive Summary

This vulnerability affects rsync versions before 3.5.0. It allows authenticated clients to bypass module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to override intended file exclusions, potentially gaining unauthorized access to restricted files.

Useful 0 Not Useful 0

Detection Guidance

Check rsync version with 'rsync --version' to see if it is 3.4.3 or earlier. Monitor logs for unusual --filter or --remote-option usage in rsync daemon commands. Look for unauthorized file access attempts that bypass module filters.

Useful 0 Not Useful 0

Impact Analysis

If you use rsync versions before 3.5.0, an attacker with access could bypass file restrictions set by the rsync daemon. This may allow them to read or access files that were meant to be excluded by module filters, potentially leading to data leaks or unauthorized access to sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected rsync versions may fail compliance audits if they cannot demonstrate adequate protection against such bypasses, risking legal and financial penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. Disable rsync daemon mode if not required. Review and tighten module filter rules to restrict client-side directives. Monitor network traffic for suspicious rsync commands.

Useful 0 Not Useful 0