4Drez

Multiple command and argument injection issues allow attackers to execute arbitrary commands by providing malicious input through various code paths. These paths include the `RSYNC CONNECT PROG` environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values, such as hostnames and hostspecs, to execute commands with the privileges of the rsync process or the invoking user.

An arbitrary file read issue exists due to improper symlink following during the handling of input configuration files. Attackers can read files accessible to the rsync daemon process by placing a symlink at a predictable path for `--files-from` or `--password-file`, or by providing a `--files-from` path that escapes the daemon module root. This affects the processing of `--files-from`, `--password-file`, and filter merge files.

An authorization bypass exists in the parsing of the auth users directive. The parser utilizes comma-only tokenization when splitting the user list, which fails to correctly process entries formatted as `@Group Name` when the group name contains a space. This causes the parser to split the entry at the space boundary, resulting in the silent discard of the associated deny rule. Consequently, an authenticated user who should be denied access based on their username or group membership can connect to a restricted module.