CVE-2024-12087 Rsync: path traversal vulnerability in rsync
A malicious rsync server can write files to arbitrary locations on the client system due to improper symlink verification during recursive transfers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-12087?
CVE-2024-12087 is a medium-severity path traversal vulnerability in Gentoo Linux, published on 14 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
Weakness: CWE-22
Which versions are affected by CVE-2024-12087?
It affects 18 products.
Linux distribution packages (40)
rsync Red Hat:rhel_aus:8.2::baseos | All versions | 0:3.1.3-7.el8_2.6 |
rsync-daemon Red Hat:rhel_aus:8.2::baseos | All versions | 0:3.1.3-7.el8_2.6 |
rsync-debuginfo Red Hat:rhel_aus:8.2::baseos | All versions | 0:3.1.3-7.el8_2.6 |
rsync-debugsource Red Hat:rhel_aus:8.2::baseos | All versions | 0:3.1.3-7.el8_2.6 |
rsync Red Hat:rhel_aus:8.4::baseos | All versions | 0:3.1.3-12.el8_4.6 |
rsync-daemon Red Hat:rhel_aus:8.4::baseos | All versions | 0:3.1.3-12.el8_4.6 |
rsync-debuginfo Red Hat:rhel_aus:8.4::baseos | All versions | 0:3.1.3-12.el8_4.6 |
rsync-debugsource Red Hat:rhel_aus:8.4::baseos | All versions | 0:3.1.3-12.el8_4.6 |
rsync Red Hat:rhel_aus:8.6::baseos | All versions | 0:3.1.3-14.el8_6.9 |
rsync-daemon Red Hat:rhel_aus:8.6::baseos | All versions | 0:3.1.3-14.el8_6.9 |
rsync-debuginfo Red Hat:rhel_aus:8.6::baseos | All versions | 0:3.1.3-14.el8_6.9 |
rsync-debugsource Red Hat:rhel_aus:8.6::baseos | All versions | 0:3.1.3-14.el8_6.9 |
rsync Red Hat:rhel_e4s:8.6::baseos | All versions | 0:3.1.3-14.el8_6.9 |
rsync-daemon Red Hat:rhel_e4s:8.6::baseos | All versions | 0:3.1.3-14.el8_6.9 |
rsync-debuginfo Red Hat:rhel_e4s:8.6::baseos | All versions | 0:3.1.3-14.el8_6.9 |
rsync-debugsource Red Hat:rhel_e4s:8.6::baseos | All versions | 0:3.1.3-14.el8_6.9 |
rsync Red Hat:rhel_e4s:8.8::baseos | All versions | 0:3.1.3-20.el8_8.4 |
rsync-daemon Red Hat:rhel_e4s:8.8::baseos | All versions | 0:3.1.3-20.el8_8.4 |
rsync-debuginfo Red Hat:rhel_e4s:8.8::baseos | All versions | 0:3.1.3-20.el8_8.4 |
rsync-debugsource Red Hat:rhel_e4s:8.8::baseos | All versions | 0:3.1.3-20.el8_8.4 |
rsync-daemon Red Hat:rhel_e4s:9.0::appstream | All versions | 0:3.2.3-9.el9_0.4 |
rsync Red Hat:rhel_e4s:9.0::baseos | All versions | 0:3.2.3-9.el9_0.4 |
rsync-debuginfo Red Hat:rhel_e4s:9.0::baseos | All versions | 0:3.2.3-9.el9_0.4 |
rsync-debugsource Red Hat:rhel_e4s:9.0::baseos | All versions | 0:3.2.3-9.el9_0.4 |
rsync-daemon Red Hat:rhel_e4s:9.2::appstream | All versions | 0:3.2.3-19.el9_2.2 |
rsync Red Hat:rhel_e4s:9.2::baseos | All versions | 0:3.2.3-19.el9_2.2 |
rsync-debuginfo Red Hat:rhel_e4s:9.2::baseos | All versions | 0:3.2.3-19.el9_2.2 |
rsync-debugsource Red Hat:rhel_e4s:9.2::baseos | All versions | 0:3.2.3-19.el9_2.2 |
rsync Red Hat:rhel_els:6 | All versions | 0:3.0.6-12.el6_10.2 |
rsync-debuginfo Red Hat:rhel_els:6 | All versions | 0:3.0.6-12.el6_10.2 |
rsync Red Hat:rhel_els:7 | All versions | 0:3.1.2-12.el7_9.2 |
rsync-debuginfo Red Hat:rhel_els:7 | All versions | 0:3.1.2-12.el7_9.2 |
rsync-daemon Red Hat:rhel_eus:9.4::appstream | All versions | 0:3.2.3-19.el9_4.2 |
rsync Red Hat:rhel_eus:9.4::baseos | All versions | 0:3.2.3-19.el9_4.2 |
rsync-debuginfo Red Hat:rhel_eus:9.4::baseos | All versions | 0:3.2.3-19.el9_4.2 |
rsync-debugsource Red Hat:rhel_eus:9.4::baseos | All versions | 0:3.2.3-19.el9_4.2 |
rsync Red Hat:rhel_eus_long_life:8.4::baseos | All versions | 0:3.1.3-12.el8_4.6 |
rsync-daemon Red Hat:rhel_eus_long_life:8.4::baseos | All versions | 0:3.1.3-12.el8_4.6 |
rsync-debuginfo Red Hat:rhel_eus_long_life:8.4::baseos | All versions | 0:3.1.3-12.el8_4.6 |
rsync-debugsource Red Hat:rhel_eus_long_life:8.4::baseos | All versions | 0:3.1.3-12.el8_4.6 |
Products include Almalinux Almalinux, Archlinux Arch Linux, Gentoo Linux, Nixos Nixos, Redhat Enterprise Linux, Redhat Enterprise Linux Eus and 12 more.
How do I fix CVE-2024-12087?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-12087 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12087 exists.
Other vulnerabilities in Gentoo Linux
- CVE-2024-12084 Rsync: heap buffer overflow in rsync due to improper checksum length handling
- CVE-2024-6387 Openssh: regresshion - race condition in ssh allows rce/dos
- CVE-2024-12085 Rsync: info leak via uninitialized stack contents
- CVE-2024-12088 Rsync: --safe-links option bypass leads to path traversal
- CVE-2024-12086 Rsync: rsync server leaks arbitrary client files
Sources
Also known as ALPINE-CVE-2024-12087, AZL-55655, AZL-55682, BELL-CVE-2024-12087, CLSA-2025-1738833802, CLSA-2025-1738958235 and 16 more.