CVE-2022-29154: Input Validation
A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can copy and overwrite arbitrary files in the client's rsync target directory and subdirectories. This flaw allows a malicious server, or in some cases, another attacker who performs a man-in-the-middle attack, to potentially overwrite sensitive files on the client machine, resulting in further exploitation.
Other sources
An arbitrary file write vulnerability in the rsync utility that allows malicious remote servers to write arbitrary files inside the directories of connecting peers.
— Red Hat
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorizedkeys file).
Rsync could allow a remote attacker to bypass security restrictions, caused by improper validation of file names. By utilize man-in-the-middle attack techniques, an attacker could exploit this vulnerability to write arbitrary files inside the directories of connecting peers.
— IBM
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue in rsync?
The vulnerability ID for this issue in rsync is CVE-2022-29154.
What is the severity of CVE-2022-29154?
The severity of CVE-2022-29154 is high.
How does the vulnerability in rsync allow an attacker to bypass security restrictions?
The vulnerability in rsync allows a remote attacker to bypass security restrictions by improperly validating file names and writing arbitrary files inside the directories of connecting peers.
Which versions of rsync are affected by CVE-2022-29154?
Versions of rsync before 3.2.5 are affected by CVE-2022-29154.
How can I fix the vulnerability in rsync?
To fix the vulnerability in rsync, you should update to version 3.2.5 or later.