## Summaryrsync versions 3.1.0 through 3.4.4 (fixed in 3.5.0) contain an access control bypass where DNS resolution failures during hostname-based hosts deny evaluation cause the daemon to fail open. Attackers can circumvent module-level IP access controls and access restricted module file trees by inducing DNS lookup failures.
## Technical Details
- Hostname-based access control uses match_hostname() to perform a forward DNS lookup of hostname tokens in hosts allow / hosts deny and compare the result against the connecting IP.
- When the forward DNS lookup fails, match_hostname() returns "no match" indistinguishable from a genuine non-match.
- As a result, allow_access() falls through and admits the connection instead of enforcing the deny rule.
- This is enabled by default for forward hostname tokens, making a default daemon that uses hostname tokens in hosts deny affected.
- Two non-attacker-controlled conditions can trigger the failure mode: a transient resolver failure, or a daemon chroot whose tree lacks resolver configuration (not a per-module chroot; module access checking occurs before per-module chroot).
- The fix is described as: treat an unresolvable token on a DENY list as a match (deny). Allow-list tokens continue to fail as non-matches, preventing DNS failures from granting access via allow rules.
## Affected
- rsync 3.1.0 through 3.4.4 (inclusive)
- Default configuration with forward lookup enabled for hostname tokens in hosts deny
## Impact
- Access control bypass: remote attackers can circumvent hosts deny rules by inducing DNS resolution failures.
- Unauthorized access to restricted module file trees is possible when deny rules are hostname-based and DNS resolution fails.
## Mitigation
1. Upgrade rsync to 3.5.0 or later.
2. If upgrade is not immediately possible, avoid hostname tokens in hosts deny (use IP-based rules) and ensure resolver configuration is present in any daemon chroot environment.
3. Validate that DNS resolution is reliable for hostname-based access control evaluation, since DNS failures can trigger the fail-open behavior.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-636