Security: SUID/SGID bits preserved via metadata can escalate privileges #191

New Issue

2026-07-30T18:34:45+02:00

TapTap commented

2026-07-30 18:34:45 +02:00

Severity: medium
Category: security
Location: src/shared/metadata.c:96-107, src/shared/file.c:61-77

Description:
When metadata preservation is enabled (-M/--preserve), the receiver restores the source file mode with chmod(path, metadata->mode & 07777). No validation is performed on the received mode. A malicious client can send a file with S_ISUID/S_ISGID/S_IWOTH bits set. If the server runs as root, this can create setuid executables or world-writable files on the destination system, leading to privilege escalation or unauthorized modification.

Suggested fix:

Strip dangerous mode bits by default (S_ISUID, S_ISGID, S_IWOTH) unless a new --preserve-perms=full or --super flag is used.
Validate that the received uid/gid are acceptable for the running user (e.g., do not allow chown to root unless running as root).
Consider refusing to setuid/setgid unless explicitly allowed by a server-side configuration flag.

Labels: security, privilege-escalation

**Severity:** medium **Category:** security **Location:** `src/shared/metadata.c:96-107`, `src/shared/file.c:61-77` **Description:** When metadata preservation is enabled (`-M`/`--preserve`), the receiver restores the source file mode with `chmod(path, metadata->mode & 07777)`. No validation is performed on the received mode. A malicious client can send a file with `S_ISUID`/`S_ISGID`/`S_IWOTH` bits set. If the server runs as root, this can create setuid executables or world-writable files on the destination system, leading to privilege escalation or unauthorized modification. **Suggested fix:** 1. Strip dangerous mode bits by default (`S_ISUID`, `S_ISGID`, `S_IWOTH`) unless a new `--preserve-perms=full` or `--super` flag is used. 2. Validate that the received uid/gid are acceptable for the running user (e.g., do not allow chown to root unless running as root). 3. Consider refusing to setuid/setgid unless explicitly allowed by a server-side configuration flag. **Labels:** security, privilege-escalation

TapTap added the security needs-triage labels 2026-07-30 18:34:45 +02:00

TapTap referenced this issue from a commit

2026-07-30 18:49:31 +02:00

fix: security issues #192 #191 #190 #189 #188 #187

TapTap closed this issue

2026-07-30 19:38:27 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: TapTap/FastSync#191