## Summaryrsync versions prior to 3.5.0 contain a symlink-following flaw (CWE-59) that can let a local attacker overwrite arbitrary filesystem files by planting a symlink at predictable ancillary output paths (e.g., --log-file, --write-batch, and daemon-mode log/statistics paths). If rsync runs with elevated privileges (setuid or privileged daemon), this can lead to local privilege escalation.
## Technical Details
The advisory describes that several “ancillary” file paths are opened without sufficient symlink confinement, including:
- --log-file
- --write-batch / --read-batch
- daemon ancillary opens such as motd, lock file, early-input file, and --config rsyncd.conf-related paths
An attacker can place a symlink at the target path (or a parent component) so that the subsequent open/write redirects to an attacker-chosen location. The advisory notes that leaf-only O_NOFOLLOW does not defend against symlinks in parent components (e.g., /tmp/<dir>/).
For --write-batch, the attacker can cause truncation/overwrite of an arbitrary file by redirecting the batch output.
For --read-batch, the advisory indicates that a planted symlink/FIFO/device can allow attacker-controlled bytes to be fed into the protocol parser.
Fix guidance from the advisory:
- Apply the “trusted-owner path walk” used for other security-sensitive paths
- Add an S_ISREG check on the opened --read-batch file
## Affected
- rsync 3.4.3 and earlier (fixed in 3.5.0)
- Reference also states affected as rsync <= 3.4.4 in a third-party advisory (consistent with “before 3.5.0”)
## Impact
- Local attacker can overwrite arbitrary files via symlink redirection of ancillary writes
- Potential local privilege escalation when rsync is executed with elevated privileges (setuid or privileged daemon configurations)
## Mitigation
1. Upgrade rsync to 3.5.0 or later (security release).
2. If immediate upgrade is not possible, avoid running rsync with elevated privileges (setuid) or in privileged daemon configurations.
3. Validate that the deployed version includes the advisory’s fixes: “trusted-owner path walk” and the S_ISREG check for --read-batch.
Detection indicators (from advisory test names):
- Presence/attempts of symlinks targeting paths used by --log-file, --write-batch, or daemon log/statistics paths (e.g., test coverage: log-file-symlink, batch-file-symlink, daemon-config-symlink).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-59