Description

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-13T15:19:43.363Z",
  "pubdate": "2026-08-13T15:19:43.363Z",
  "executiveSummary": "An IP address spoofing vulnerability exists in the rsync daemon before version 3.5.0, allowing unauthenticated remote attackers to bypass IP-based access control mechanisms.\nThe vulnerability stems from the daemon's handling of the PROXY protocol header, which permits incoming connections to supply a crafted source IP address.\nAttackers capable of establishing a direct network connection to the rsync daemon can inject a forged source address within the PROXY protocol header.\nThis circumvents configured hosts allow and hosts deny rules, granting unauthorized access to systems or resources that should otherwise be restricted based on the originator's actual network location.\nThe primary impact is the unauthorized bypass of security perimeters, potentially exposing sensitive synchronization targets to arbitrary external entities.\nExploitation requires direct network connectivity to the target daemon and the ability to inject custom protocol data during the initial handshake phase without requiring prior authentication.",
  "technicalDetails": "The root cause of the vulnerability lies in the rsync daemon's improper validation and trust of the PROXY protocol header before enforcing IP-based access control lists (ACLs).\nAffected versions include all rsync daemon implementations prior to version 3.5.0.\nThe vulnerable component is the network connection initialization and parsing routine responsible for interpreting incoming PROXY protocol headers.\nAuthentication requirements are absent, as the vulnerability is triggered during the pre-authentication phase of the connection establishment.\nPrivilege requirements are minimal; any unauthenticated remote attacker capable of routing network traffic to the listening rsync port can initiate the attack vector.\nThe network exposure is restricted to environments where the rsync daemon is directly accessible over the network and configured to parse PROXY headers or fails to restrict them appropriately.\nPayload behavior involves prepending a crafted PROXY protocol header containing a forged source IP address to the raw TCP stream directed at the rsync daemon.\nThe attack flow proceeds as follows: First, the attacker establishes a direct TCP connection to the vulnerable rsync daemon port. Second, the attacker immediately sends a malicious PROXY protocol header containing an internally trusted or explicitly allowed spoofed source IP address. Third, the rsync daemon parses this header and attributes the connection to the forged IP address rather than the actual socket peer address. Fourth, the daemon evaluates the connection against the hosts allow and hosts deny configuration rules using the fabricated IP address. Fifth, upon successfully matching an allowed rule, the daemon grants access, bypassing the security restrictions that would have blocked the attacker's true network address, thereby enabling unauthorized interaction with the service."
}