CVE-2017-17433

What it actually does

The recv_files function in rsync performs file metadata updates prior to validating the filename against daemon_filter_list, enabling remote bypass of access restrictions.

Why it matters to the business

Organizations using affected rsync-dependent monitoring exporters face limited risk of unauthorized file metadata manipulation due to the flaw's age, low exploit probability, and absence from known exploitation lists.

How an attack unfolds

An attacker connects to a vulnerable rsync daemon and crafts a file transfer request that triggers metadata processing before the daemon_filter_list check occurs, bypassing intended access controls.

How to fix it

Upgrade prometheus-blackbox-exporter (Chainguard), prometheus-blackbox-exporter (Wolfi), prometheus-blackbox-exporter-compat (Chainguard), and prometheus-blackbox-exporter-compat (Wolfi) to version 0.25.0-r5 or later; ensure underlying rsync is also patched.

How to confirm the fix worked

Confirm package versions match or exceed 0.25.0-r5, review daemon_filter_list configurations, and test access controls with crafted transfer attempts.

Typical attack path

1. Establish connection to rsync daemon over network
2. Send crafted file transfer request with specific metadata
3. Trigger premature metadata update before filter validation
4. Access or modify files outside intended restrictions

How to detect it

Review rsync daemon logs for unexpected metadata operations or connections from untrusted sources; correlate with filter list bypass attempts.

What your security team should do

• Apply the specified package upgrades immediately across all environments
• Audit rsync daemon configurations for proper filter list usage
• Monitor for any legacy rsync deployments and replace where possible