CVE-2024-12088

What it actually does

The rsync client using --safe-links does not recursively validate that symlink destinations received from the server are free of additional symlinks, enabling path traversal that permits arbitrary file writes outside the intended destination directory.

Why it matters to the business

Organizations relying on rsync for file synchronization across 61 downstream dependents face risk of unauthorized data modification or corruption during transfers from untrusted sources, potentially disrupting backup, deployment, or data replication workflows.

How an attack unfolds

An attacker sets up a malicious rsync server or intercepts a client connection, then crafts a response containing a symlink whose target itself contains another symlink that traverses outside the allowed directory; when the client uses --safe-links the flawed verification allows the write to succeed.

How to fix it

Upgrade affected rsync packages to the fixed versions provided for each distribution; for mongodb on Ubuntu 18.04 LTS apply version 1:3.6.3-0ubuntu1 or later. Disable --safe-links when connecting to untrusted servers until patches are applied.

How to confirm the fix worked

Confirm rsync binary or package version matches or exceeds the listed fixed release, then test synchronization of a crafted symlink set against a controlled server to verify writes remain confined to the destination directory.

Typical attack path

1. Attacker positions a malicious or compromised rsync server reachable by the target client
2. Client initiates synchronization with the --safe-links flag against the attacker-controlled server
3. Server returns a crafted symlink whose destination embeds a second symlink performing directory traversal
4. Client verification logic fails to detect the nested link and performs the file write outside the intended tree

How to detect it

Review rsync client logs for transfers involving multiple nested symlinks or unexpected write paths; correlate with process execution of rsync against external or untrusted hosts and inspect destination directories for files written outside expected boundaries.

What your security team should do

• Apply the specified fixed package versions immediately on all Ubuntu 18.04 LTS systems running mongodb or rsync
• Inventory all uses of rsync with --safe-links and restrict them to trusted endpoints
• Monitor EPSS and exploit maturity indicators for any increase in observed activity