Rsync Recursive path traversal

Summaryinfo

A vulnerability categorized as critical has been discovered in Rsync. The impacted element is an unknown function of the component Recursive Handler. Executing a manipulation can lead to path traversal. This vulnerability appears as CVE-2024-12087. There is no available exploit. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as critical was found in Rsync (affected version unknown). This vulnerability affects an unknown functionality of the component Recursive Handler. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.

The advisory is shared for download at kb.cert.org. This vulnerability was named CVE-2024-12087. The exploitation appears to be easy. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

The vulnerability scanner Nessus provides a plugin with the ID 214143 (Ubuntu 16.04 LTS : rsync vulnerabilities (USN-7206-1)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the databases at Tenable (214143), EUVD (EUVD-2024-50583) and CERT Bund (WID-SEC-2025-2633). Once again VulDB remains the best source for vulnerability data.

Affected

• Aruba AOS-CX

Productinfo

Type

• File Transfer Software

Name

• Rsync

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion