CVE-2020-14387
📋 TL;DR
A certificate validation flaw in rsync allows man-in-the-middle attacks when using rsync over SSL/TLS. Attackers can intercept and modify data transfers using valid certificates for different hostnames. This affects rsync versions 3.2.0pre1 through 3.2.3.
💻 Affected Systems
- rsync
📦 What is this software?
Rsync by Samba
Rsync by Samba
Rsync by Samba
Rsync by Samba
Rsync by Samba
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of data confidentiality and integrity during rsync transfers, allowing attackers to steal sensitive data or inject malicious content.
Likely Case
Data interception and modification during rsync operations over untrusted networks, potentially leading to data breaches or malware distribution.
If Mitigated
Limited impact if rsync is used only on trusted internal networks or without SSL/TLS.
🎯 Exploit Status
Exploitation requires man-in-the-middle position and a valid certificate for any hostname. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.4
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1875549
Restart Required: No
Instructions:
1. Download rsync 3.2.4 or later from https://rsync.samba.org/
2. Compile and install: ./configure && make && make install
3. For package managers: Use your distribution's package manager to update rsync
🔧 Temporary Workarounds
Use SSH instead of SSL/TLS
allUse rsync over SSH (rsync user@host:/path) instead of rsync:// with SSL
rsync -avz user@remote_host:/source/path /destination/path
Disable rsync SSL/TLS usage
allConfigure systems to not use rsync:// URLs with SSL
🧯 If You Can't Patch
- Restrict rsync SSL/TLS usage to trusted internal networks only
- Implement network segmentation and monitor for unauthorized rsync SSL/TLS traffic
🔍 How to Verify
Check if Vulnerable:
Check rsync version: rsync --version | head -1Check Version:
rsync --version | head -1Verify Fix Applied:
Verify version is 3.2.4 or higher: rsync --version | grep -q 'version 3\.2\.[4-9]\|version [3-9]\.[3-9]' && echo 'Patched'📡 Detection & Monitoring
Log Indicators:
- Failed SSL certificate validations in rsync logs
- Unexpected rsync connections from unknown sources
Network Indicators:
- Unusual rsync traffic patterns
- rsync SSL/TLS connections to unexpected destinations
SIEM Query:
source="rsync" AND (event="ssl_error" OR event="certificate_mismatch")