Arbitrary File Write in rsync via Absolute Path Bypass

Executive Summary

This vulnerability affects rsync versions before 3.5.0. It allows attackers to write files outside the intended destination directory by exploiting the --temp-dir or --link-dest options with absolute paths. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attackers to write files to any accessible location where the rsync process has permissions.

Useful 0 Not Useful 0

Detection Guidance

Check rsync version with 'rsync --version'. If it shows version 3.4.3 or earlier, the system is vulnerable. Monitor for unexpected file writes outside intended directories, especially when --temp-dir or --link-dest options are used with absolute paths.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to write arbitrary files to sensitive system locations, potentially leading to local privilege escalation, system compromise, or unauthorized data access. The impact depends on the permissions of the rsync process, but could include overwriting critical system files or installing malicious software.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable rsync versions may face compliance violations if attacker-controlled files overwrite sensitive data or system configurations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. Avoid using --temp-dir or --link-dest with absolute paths. Review rsync configurations for unsafe path handling. Restrict rsync daemon access to trusted networks.

Useful 0 Not Useful 0