CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable to a time-of-check to time-of-use (TOCTOU) race condition, which allows attackers to manipulate destination path components and redirect file writes to unintended locations. This vulnerability can lead to unauthorized file access or data corruption, particularly if an attacker can substitute a symlink in the destination path. Organizations using affected versions of rsync should prioritize updating to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver's working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.