Skip to content

GHSA-pfj8-79vq-xgvr

CVE Information

rsyncd.conf(5) documents that if the auth users value starts with a comma, splitting is performed on commas ALONE, so that an NSS group name containing a space can be expressed:

auth users = ,@Group Name:deny, alice:rw

auth_server() ignored the leading comma and always tokenised on commas AND whitespace (strtok(users, " ,\t")). @Group Name:deny therefore split into @Group -- which matches only a group literally named "Group", so the intended deny never fires -- and Name:deny, treated as a username.

auth users is first-match, so the rule the administrator wrote to deny (or restrict to :ro) a group is skipped and a later :rw entry matches instead. A member of the group the administrator intended to exclude is granted the access the configuration says they must not have. The failure is silent: the configuration parses without error and looks correct.

Fixed by parsing the value with conf_strtok() so a leading comma selects comma-only splitting as documented.

Affected: 3.1.0 through 3.4.4 (@group support in auth users entered in 3.1.0)

Fixed in: 3.5.0

Reporter: Andres Berbescu

Test: daemon-auth-users-comma-only