In rsync, the utility for file synchronization and backup, a vulnerability (CVE-2022-29154) has been identified, allowing an attacker-controlled rsync server to write or overwrite arbitrary files in the target directory on the user's side. The attack may also potentially occur due to a man-in-the-middle (MITM) intervention in the transit traffic between the client and a legitimate server. The issue has been resolved in the test release Rsync 3.2.5pre1.
The vulnerability resembles past issues in SCP and is also caused by the server deciding the location of the written file, while the client does not properly verify what is returned by the server against what was requested, allowing for server the writing of files that were not initially requested by the client. For example, when a user copies files to their home directory, un server it may instead issue files named .bash_aliases or .ssh/authorized_keys instead of the requested files, and they will be saved in the user's home directory.
Fonte: opennet.ru
