CVE-2024-12087: Rsync: path traversal vulnerability in rsync
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
Other sources
Rsync: path traversal vulnerability in rsync
— Microsoft
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
When the syncing of symbolic links is enabled, either through the -l or -a (--archive) flags, a malicious server can make the client write arbitrary files outside of the destination directory.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.2.3-4+deb11u3Fixed in 3.2.7-1+deb12u2Fixed in 3.3.0+ds1-4
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-12087?
CVE-2024-12087 is classified as a High severity vulnerability due to its potential for exploitation in path traversal scenarios.
How do I fix CVE-2024-12087?
To fix CVE-2024-12087, it is recommended to update rsync to versions 3.2.3-4+deb11u3, 3.2.7-1+deb12u2, or 3.3.0+ds1-4.
What software is affected by CVE-2024-12087?
CVE-2024-12087 affects the rsync software, specifically versions up to 3.2.3-4+deb11u1 and 3.2.7-1.
What is the impact of CVE-2024-12087?
The impact of CVE-2024-12087 is that it allows an attacker to access files outside of the intended directory via path traversal.
Is CVE-2024-12087 exploitable remotely?
Yes, CVE-2024-12087 can be exploited remotely if an attacker has access to a vulnerable rsync server configured with the --inc-recursive option.