CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable to multiple command and argument injection flaws that allow attackers to execute arbitrary commands by manipulating unsanitized user inputs, such as hostnames and hostspecs. This could lead to unauthorized command execution with the privileges of the rsync process or the invoking user, posing a significant risk to system integrity. Organizations using affected versions of rsync should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.