Rsync — CraftedSignal Threat Feed

Rsync TOCTOU Vulnerability Allows File Write Redirection

hello@craftedsignal.io — Wed, 20 May 2026 13:17:51 +0000

Rsync before version 3.4.3 is susceptible to a time-of-check to time-of-use (TOCTOU) race condition in how the daemon handles files. This vulnerability allows an attacker with write access to a Rsync module path to manipulate file writes. By replacing parent directory components with symbolic links, an attacker can redirect file writes to locations outside of the intended directories. The vulnerability is triggered when the chroot setting is false. This can lead to arbitrary file creation or overwriting, and potentially escalate privileges if the Rsync daemon runs with elevated permissions. This vulnerability was published in May 2026 and is identified as CVE-2026-29518.

Attack Chain

Attacker gains write access to a Rsync module path, either through compromised credentials or misconfiguration.
Attacker identifies a target file or location outside of the intended module path.
Attacker crafts a malicious directory structure within the Rsync module path, replacing parent directories with symbolic links pointing to attacker-controlled locations.
Attacker initiates a file transfer operation using Rsync, targeting a file within the crafted malicious directory structure.
Rsync daemon performs initial checks on the directory structure.
Between the check and the actual file write, the attacker modifies the symbolic links to redirect the write operation to the target file or location outside of the Rsync module path.
Rsync daemon writes the file to the attacker-specified location, bypassing intended access controls.
If the attacker overwrites sensitive system files, this can lead to privilege escalation.

Impact

Successful exploitation of this vulnerability allows attackers to create or overwrite arbitrary files on the system, potentially leading to privilege escalation if the Rsync daemon is running with elevated privileges. If the attacker overwrites critical system binaries or configuration files, they can gain complete control of the system. The impact is limited to systems where the chroot setting is false.

Recommendation

Upgrade Rsync to version 3.4.3 or later to patch CVE-2026-29518.
Apply the “Detect Rsync TOCTOU Attempt via Symlink Creation” and “Detect Rsync TOCTOU Attempt via File Modification” Sigma rules to identify potential exploitation attempts.
Ensure the chroot setting is enabled in Rsync configurations to mitigate the vulnerability.

Rsync Integer Overflow Vulnerability Leading to Information Disclosure (CVE-2026-43618)

hello@craftedsignal.io — Wed, 20 May 2026 02:18:47 +0000

Rsync, a widely used utility for synchronizing files between computer systems, is susceptible to an integer overflow vulnerability (CVE-2026-43618) within its compressed-token decoder. Specifically, versions 3.4.2 and earlier fail to adequately validate a 32-bit signed counter, leading to an overflow condition. A malicious rsync sender can exploit this flaw by crafting a specially designed data stream that triggers the overflow during decompression on the receiving end. This overflow can cause the receiver process to read data outside of the intended buffer boundaries. Successful exploitation results in the disclosure of sensitive process memory contents.

Attack Chain

Attacker crafts a malicious data stream designed to exploit the integer overflow in the rsync compressed-token decoder.
The attacker initiates an rsync session with a vulnerable rsync server (version 3.4.2 or prior).
During data transfer, the malicious data stream is sent to the rsync server.
The rsync server attempts to decompress the data stream using the vulnerable compressed-token decoder.
The 32-bit signed counter overflows due to the crafted data stream.
The overflow causes the rsync server process to read data from memory locations outside the intended buffer.
Sensitive information, such as environment variables, passwords, heap data, stack data, and library memory pointers, are exposed.
The attacker gains access to the disclosed memory contents, potentially facilitating further exploitation and bypassing ASLR.

Impact

Successful exploitation of CVE-2026-43618 leads to information disclosure on the affected system. An attacker can potentially access sensitive data residing in the rsync process memory, including environment variables, passwords, and memory addresses. This leaked information can be leveraged to bypass ASLR, escalate privileges, and perform lateral movement within the network. The vulnerability poses a significant risk to the confidentiality and integrity of the affected systems.

Recommendation

Upgrade rsync to a version higher than 3.4.2 to patch CVE-2026-43618.
Deploy the Sigma rule Detect Rsync CVE-2026-43618 Integer Overflow Attempt to detect potential exploitation attempts by monitoring process command-line arguments.
Review systems running vulnerable rsync versions for suspicious network connections and memory access patterns.