CVE-2024-12087

What it actually does

Path traversal in rsync stemming from insufficient symlink verification during --inc-recursive transfers; deduplication checks performed per file-list allow a malicious server to write files outside the client's intended destination directory.

Why it matters to the business

Attackers controlling an rsync server can place malicious or unauthorized files into arbitrary locations on client systems, risking code execution, configuration tampering, or data corruption across Linux distributions and enterprise environments that rely on rsync for file synchronization.

How an attack unfolds

An attacker hosts a malicious rsync server and waits for or lures a client into initiating a transfer with the default-enabled --inc-recursive option; crafted file lists containing symlinks combined with per-list deduplication bypasses cause the client to write attacker-controlled content to arbitrary paths on the client filesystem.

How to fix it

Upgrade rsync to a patched release that enforces proper symlink verification regardless of --inc-recursive; where upgrades are unavailable, disable --inc-recursive on clients, restrict rsync connections to trusted servers via network controls, and avoid synchronizing with untrusted endpoints.

How to confirm the fix worked

Confirm rsync binary version meets or exceeds the first patched release for each distribution; perform test transfers from controlled servers while monitoring for writes outside the destination directory; review rsync configuration to ensure --inc-recursive is not enabled against untrusted servers.

Typical attack path

1. Host or compromise an rsync server that responds to client connections
2. Ensure the client uses --inc-recursive (default for many rsync invocations)
3. Return specially constructed file lists containing symlinks during incremental recursion
4. Leverage missing symlink validation and per-list deduplication to write files outside the target directory

How to detect it

Review rsync client logs and system audit logs for connections to unexpected servers; inspect for files appearing in directories outside normal rsync destinations during transfer windows; correlate process execution of rsync with subsequent file-write events in atypical paths.

What your security team should do

• Prioritize patching rsync on all affected systems as soon as fixed packages are released by vendors
• Inventory and restrict rsync usage to only trusted internal servers
• Implement network segmentation or firewall rules limiting outbound rsync traffic
• Add monitoring for unexpected file creation during rsync operations