Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Rex, a Perl tool for managing server configurations, could allow an attacker to intercept remote file transfers. Rex inadvertently bypasses critical security checks when transferring files over SSH, potentially exposing sensitive information or allowing malicious files to be introduced during the process. The main concern is confirming relevance and exposure.
- Remote file transfers lack host key verification.
- Attackers could intercept data or inject malicious content.
- Confirm relevance and assess exposure to internal systems.
Attack Path
How an attacker could exploit the issue
An attacker could compromise remote rsync transfers by redirecting the connection to a malicious server before the legitimate host key is verified. This allows them to present a fake host key, and if the transfer is then authenticated using a password, the attacker can intercept sensitive connection details, upload local files to their server, or overwrite local files with data from their server.
- Network access required.
- Remote rsync transfers.
- Data compromise and modification.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an attacker to intercept remote rsync transfers by presenting a malicious SSH host key. When this occurs, sensitive local files could be uploaded to an attacker-controlled server, or an attacker could trick the system into downloading arbitrary files from their server, potentially overwriting local data.
- Sensitive local files may be uploaded.
- Attacker redirects rsync connection.
- Data can be exfiltrated or overwritten.
Operational Fix
Recommended remediation, mitigation, and detection steps
The `Rex` tool's use of `rsync` with hardcoded host key checking disabled presents a risk of man-in-the-middle attacks during remote transfers. Application owners or the platform team managing `Rex` deployments should identify all instances of `Rex`, confirm their exposure and criticality, and then coordinate remediation.
- Application or platform teams should own this.
- Verify `Rex` instances and their network exposure.
- Plan remediation based on identified risk.
