In rsync, a utility for file synchronization and backup, a vulnerability (CVE-2022-29154) has been identified that allows arbitrary files to be written or overwritten in the target directory on the user's side when connecting to a malicious rsync server. A potential attack can also occur as a result of a Man-In-The-Middle (MITM) intervention in the transit traffic between the client and a legitimate server. The issue has been resolved in the test release of Rsync 3.2.5pre1.
The vulnerability resembles past issues in SCP and is caused by the server deciding the location of the file being written, while the client does not properly verify what is being provided by the server against what was requested, allowing poslužitelju files that were not originally requested by the client to be written. For example, when a user copies files to the home directory, server it may present files named .bash_aliases or .ssh/authorized_keys instead of the requested files, and they will be saved in the user's home directory.
Izvor: opennet.ru
