Skip to content

GHSA-9cgc-64g4-3gv5

CVE Information

The rrsync SSH forced-command wrapper (a) validated each argument with realpath() and then exec'd rsync against the same name, leaving a TOCTOU window to flip a component to an escaping symlink after the check; and (b) left dangerous options enabled inside a restricted (non-/) directory: --copy-unsafe-links (dereferences a symlink pointing outside the tree and copies the referent out -- exfiltration), -D/--specials (special-file creation), and a --log-file that followed a symlink.

Fix: pin each component with os.open(O_PATH|O_NOFOLLOW)+fstat and exec against the pinned fd; deny --copy-unsafe-links; force --no-D; refuse a symlinked logfile.

Tests: rrsync-symlink, rrsync-copy-unsafe-links-denied, rrsync-specials-denied, rrsync-logfile-symlink.

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)