bencteux.fradvisory

CVE-2023-38336: Command injection in netkit-rcp

Writeup by the researcher who reported CVE-2023-38336, a command injection vulnerability in Netkit's rcp implementation (Debian's rsh-client package). The bug is in susystem() in rcp/rcp.c, which passes filename arguments unsanitized to `sh -c`, letting an attacker who controls a copied filename execute arbitrary commands (demonstrated via `ltrace` with a filename like `";whoami"`); the binary is SUID root but drops privileges via setuid() before executing the shell, so the flaw grants command execution as the invoking user rather than root escalation. No patch exists since the project has no upstream maintainer, and the author recommends migrating from RSH to SSH.