关联漏洞
标题:rsync rsyncd 安全漏洞 (CVE-2018-5764)Description:rsync是澳大利亚软件开发者安德鲁-垂鸠（Andrew Tridgell）和保罗-麦可拉斯（Paul Mackerras）共同研发的一套用于类Unix系统中的数据镜像备份应用程序，它能够同步更新两处计算机的文件与目录，并利用差分编码减少数据传输。rsyncd是其中的一个守护进程。 rsync 3.1.3之前的版本中的rsyncd的options.c文件的‘parse_arguments’函数存在安全漏洞，该漏洞源于程序没有阻止多次使用--protect-args。远程攻击者可利用该漏洞绕过参数过滤保护机
Description
SyncShield - Browser Extension to Detect Unsafe Rsync Commands (CVE-2018-5764)
介绍
# 🔐 SyncShield — Browser Extension for CVE-2018-5764 Detection
> **Detect unsafe Rsync commands before they become exploits**
A lightweight, privacy-focused browser extension developed as part of **Final Year Project (FYP01) NWS/129/23B** to detect missing `--protect-args` flag in Rsync commands — preventing remote command execution via **CVE-2018-5764**.
✅ Works entirely offline
✅ No server connections or data collection
✅ Real-time scanning & alerts
✅ Educational & mitigation-focused
✅ Built for students, sysadmins, and security enthusiasts
---
## 👥 Team Members
| No. | Name | Student ID | Role & Responsibilities |
|-----|-------------------------------------|---------------|--------------------------------------------------|
| 1 | Muhammad Nur Faiz Bin Ahmad Fauzi | NWS23070251 | Group Leader & Frontend Developer |
| 2 | Wan Muhammad Afifuddin Bin Wan Ahmad| NWS23070157 | Command Scanner Developer |
| 3 | Waleed Adam Bin Riza Farouk | NWS23070265 | Testing Lead & Documentation Writer |
| 4 | Roshazne Elia Binti Mohd Roshidi | NWS23070105 | Researcher & Presentation Leader |
**Supervisor**: Sir Amir Hakeem
**Intake**: July 2023 | **Trade**: CID (Computer Information & Data)
**Project Code**: NWS/129/23B
**Submission**: January 2025
---
## 🎯 Project Overview
Rsync is a powerful utility for file synchronization — but if misconfigured (especially without `--protect-args`), it can lead to **remote command execution** via specially crafted filenames or arguments (CVE-2018-5764).
SyncShield helps users:
- ✅ Paste or upload Rsync commands/scripts
- ✅ Instantly detect unsafe patterns (missing `--protect-args`, unquoted inputs, etc.)
- ✅ Get clear, non-technical alerts and mitigation steps
- ✅ Learn secure Rsync practices — no CLI expertise required
> ⚠️ **Scope**: Focused only on CVE-2018-5764 — simple, targeted, and achievable within academic timeline.
---
## 🧩 Project Structure
syncshield-github/
├── website/ # Public-facing site: project info, download, demo
├── extension/ # Browser extension source code (Chrome/Firefox)
└── README.md # You are here!
---
## 🌐 Live Demo (GitHub Pages)
View the official project website at:
👉 **[https://waleedadam360-web.github.io/SyncShield/](https://waleedadam360-web.github.io/SyncShield/)**
> 💡 *Note: You must enable GitHub Pages in repo Settings → Pages → Branch: `main` → Folder: `/website`*
---
## 🛠️ Key Features
### 1. Rsync Argument Analyzer
Scans user-inputted Rsync commands to detect absence of `--protect-args` — the critical flag that prevents shell injection.
### 2. Detection of Unsafe Input Patterns
Flags unquoted variables, shell metacharacters, and unsanitized user inputs that could trigger CVE-2018-5764.
### 3. Real-Time Alerts & Risk Warnings
Provides immediate visual feedback with:
- Risk level (Low/Medium/High)
- Plain-language explanation
- Impact summary
### 4. Mitigation Guidance
Offers actionable fixes:
```bash
# ❌ Unsafe
rsync -av /src user@host:/dest
# ✅ Safe
rsync -av --protect-args /src user@host:/dest
文件快照
[4.0K] /data/pocs/bf6537a539652d34168a470a9c6e1f7b00ddd479
├── [4.0K] extension
├── [1.0K] LICENSE
├── [3.2K] README.md
└── [4.0K] website
├── [4.0K] css
│ ├── [7.7K] styles.css
│ ├── [4.5K] styles_v1_clean.css
│ ├── [ 733] styles_v2_dots.css
│ └── [ 596] styles_v3_gradient.css
├── [4.0K] images
│ ├── [9.4K] icon.png
│ ├── [ 32K] lia.jpg
│ ├── [ 11K] logo.png
│ ├── [ 43K] paeh.png
│ ├── [ 12K] pip.jpg
│ ├── [ 577] ss naming.svg
│ └── [ 45K] waleed.png
├── [7.4K] index.html
└── [4.0K] js
└── [ 796] main.js
5 directories, 15 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。