iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability

The impact of CVE-2024-11944 is severe. Successful exploitation allows an attacker to gain complete control over the affected TrueNAS CORE system, effectively achieving root access. This can lead to data breaches, system corruption, and the installation of malicious software. Given the lack of authentication required, the vulnerability is easily exploitable from any network-connected device. The ability to execute code as root grants the attacker the highest level of privileges, enabling them to compromise the entire storage infrastructure and potentially pivot to other systems on the network. This vulnerability shares similarities with other directory traversal exploits where attackers leverage insufficient input validation to gain unauthorized access and execute commands.

Organizations heavily reliant on TrueNAS CORE for data storage and management are at significant risk. This includes small to medium-sized businesses (SMBs) and enterprises utilizing TrueNAS for file sharing, backups, and virtual machine hosting. Shared hosting environments using TrueNAS are particularly vulnerable due to the potential for cross-tenant exploitation.

• freebsd / server:

journalctl -u zed -g 'tarfile.extractall'

• freebsd / server:

find /usr/local -type f -mtime -1 -print

• generic web:

curl -I http://<truenas_ip>/path/to/malicious/file.tar.gz

• generic web:

 grep -i 'tarfile.extractall' /var/log/nginx/access.log

1. 2024-12-30Disclosure

   disclosure

1. Reserviert2024-11-27
2. Veröffentlicht2024-12-30
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-11944 is to upgrade to a patched version of TrueNAS CORE as soon as possible. Until the upgrade can be performed, restrict network access to the TrueNAS CORE system to only trusted sources. Implement strict firewall rules to limit inbound connections. Monitor system logs for any suspicious activity, particularly attempts to access or manipulate files within the /usr/local/ directory. Consider using a Web Application Firewall (WAF) to filter out malicious requests targeting the vulnerable endpoint. After upgrading, verify the fix by attempting to extract a tar archive with a specially crafted path designed to trigger the directory traversal vulnerability; the extraction should fail with an error indicating insufficient permissions.