rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as –copy-unsafe-links, -D, and –log-file through rrsync to read or write files outside the permitted directory subtree.
Weakness
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | RedHat | rsync-0:3.5.0-3.el10_2 | * |
| Red Hat Enterprise Linux 8 | RedHat | rsync-0:3.1.3-28.el8_10 | * |
| Red Hat Enterprise Linux 9 | RedHat | rsync-0:3.2.7-1.el9_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | rsync-0:3.2.7-1.el9_8 | * |
| Red Hat Cost Management On-Premise 1 | RedHat | costmanagement/costmanagement-ui-rhel10:1791460851 | * |
Potential Mitigations
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/132.html
- https://cwe.mitre.org/data/definitions/17.html
- https://cwe.mitre.org/data/definitions/35.html
- https://cwe.mitre.org/data/definitions/76.html