CVE-2023-38336

What it actually does

netkit-rcp invokes susystem which passes attacker-controlled filenames directly to /bin/sh without sanitization, enabling arbitrary command execution with the privileges of the rcp process.

Why it matters to the business

Systems still running the unmaintained rsh-client package can be fully compromised by remote attackers, resulting in data theft, ransomware deployment, or use as a foothold for further network attacks; the package has no vendor fixes and remains exploitable years after disclosure.

How an attack unfolds

An attacker crafts a filename containing shell metacharacters and command payloads, then initiates an rcp transfer (or similar netkit-rcp invocation) that causes susystem to expand the filename through /bin/sh, executing the injected commands.

How to fix it

Remove the netkit-rcp and rsh-client packages entirely; replace any remaining rcp/rsh usage with scp, sftp, or rsync over SSH; if removal is impossible, isolate affected systems and block inbound rsh/rcp traffic at network boundaries.

How to confirm the fix worked

Confirm the netkit-rcp binary is absent or its package is removed; attempt a controlled filename injection test in an isolated environment to verify the shell expansion path is no longer reachable.

Typical attack path

1. identify hosts exposing rsh/rcp services or containing the netkit-rcp binary
2. craft a malicious filename embedding shell commands (e.g., ;id>/tmp/pwned)
3. trigger netkit-rcp with the crafted filename via rcp, rsh, or automated scripts
4. achieve code execution and establish persistence or lateral movement

How to detect it

Search endpoint and process-creation logs for netkit-rcp or rcp invocations containing shell metacharacters in arguments or filenames; inspect syslog and auditd records for susystem or /bin/sh child processes spawned by rcp; review file-transfer automation logs for unexpected command output or newly created files with suspicious names.

• rcp.*[;&|`$]
• susystem
• netkit-rcp
• /usr/bin/rcp
• rsh-client

What your security team should do

• Immediately uninstall netkit-rcp / rsh-client from all production systems
• Scan package inventories and configuration management databases for any remaining instances
• Block TCP/UDP ports associated with rsh/rcp at network perimeters
• Add the package name to disallowed-software policies and CI/CD blocklists
• Hunt for historical rcp process executions in endpoint telemetry for the past 90 days