CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable to an arbitrary file read issue due to improper handling of symlinks in input configuration files, such as --files-from and --password-file. This vulnerability allows attackers to exploit the rsync daemon to access sensitive files on the system, potentially leading to data exposure. Organizations using rsync in environments where the daemon is exposed should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.