CVE-2022-29154

CVSS N/A NVD score not yet provided.

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).

Exploit

Run the server and an additional file to be requested:

ssh-mitm server --scp-interface CVE-2022-29154 --rsync-inject-file /bin/ls

Connect to client to the man in the middle server. Note in this example the ssh command has to be sepcified with another port.

rsync -e 'ssh -p 10022' 'user@SERVER:/bin/bash' .

If your rsync version is vulnerable you will reveive 2 files from the server.

Mitigation

When dealing with an untrusted sending host, it is safest to copy into a dedicated destination directory for the remote content (i.e. don’t copy into a destination directory that contains files that aren’t from the remote host unless you trust the remote host).

References: