Loading vulnerability…
Path Traversal via Symlink Validation in rsync --inc-recursive
CVE-2024-12087 is a path traversal vulnerability in rsync's incremental-recursion processing. When the --inc-recursive option is in use, insufficient symbolic-link verification combined with per-file-list deduplication checks can permit a malicious rsync server to cause writes outside the client’s intended destination directory. The option is enabled by default for many client options and may also be enabled by the server even when the client did not explicitly request it.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A malicious rsync server can write attacker-controlled files outside the intended destination directory on the client, to arbitrary locations named after valid client directories or paths. This can compromise the integrity of files outside the synchronization target.
If you can’t patch tonight, do this now.
Until patched, avoid synchronizing from untrusted or unverified rsync servers. Restrict rsync network exposure and access to trusted endpoints; where operationally feasible, require authentication for rsync access.
Patch, then assume compromise.
Upgrade rsync to version 3.4.0 or a later vendor-provided patched release. Where rsync is supplied by an operating-system vendor or product, install the corresponding patched package or security update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.