CVE-2024-12747

What it actually does

Race condition in symbolic link handling allows an attacker to replace a regular file with a symlink during rsync processing, bypassing the default skip behavior and enabling symlink traversal that can expose file contents outside the intended transfer scope.

Why it matters to the business

Organizations relying on rsync for file synchronization face risk of unauthorized data exposure or privilege escalation on systems where the rsync process runs with elevated rights, potentially affecting backup integrity and sensitive data confidentiality.

How an attack unfolds

An attacker with local access observes or influences the rsync operation timing, replaces a targeted regular file with a symbolic link pointing outside the allowed directory at the precise moment rsync evaluates the path, causing the tool to follow the link and transfer or expose unintended files.

How to fix it

Upgrade rsync to a version that eliminates the race condition in symlink handling, enforce least-privilege execution for rsync processes, and consider command-line options that disable symlink following where operationally feasible.

How to confirm the fix worked

Compare installed rsync version against vendor advisories for the fix, review rsync configuration for symlink-related flags, and perform controlled tests that attempt symlink replacement during simulated transfers to confirm the bypass is no longer possible.

Typical attack path

1. Identify rsync processes or scheduled sync jobs handling user-controlled directories
2. Monitor file system activity to detect the window between path check and content access
3. Atomically replace a regular file with a crafted symbolic link
4. Trigger or wait for the rsync operation to process the replaced path
5. Access or exfiltrate data reached through the traversed symlink

How to detect it

Review rsync log files and system audit logs for unexpected symlink creations or traversals during transfer windows, correlate with file modification timestamps around scheduled sync jobs, and inspect for processes that rapidly replace regular files with links in directories being synchronized.

What your security team should do

• Prioritize patching rsync across all systems that perform automated or privileged file synchronization
• Audit rsync usage and reduce privileges of associated service accounts
• Enable additional logging for symlink-related events during transfers
• Monitor EPSS and exploit maturity indicators for changes in this race condition