Security researchers Daan Keuper, Thijs Alkemade, and Khaled Nassar from Computest Sector 7 disclosed a critical vulnerability in TrueNAS CORE, a widely-used open-source storage operating system developed by iXsystems.
The vulnerability, CVE-2024-11944, allows network-adjacent attackers to execute arbitrary code on affected installations without requiring authentication.
This discovery was presented during the renowned cybersecurity competition Pwn2Own.
2024 MITRE ATT&CK Evaluation Results for SMEs & MSPs -> Download Free Guide
Vulnerability Details
The flaw resides in the tarfile.extractall method used by TrueNAS CORE. Improper validation of user-supplied paths enables attackers to exploit this directory traversal vulnerability.
By crafting a malicious payload, an attacker can perform unintended file operations, potentially leading to remote code execution (RCE) with root privileges.
While the vulnerability has a high CVSS score of 7.5, signaling its critical impact, exploitation is complex due to its need for precise conditions.
Advanced attackers, leveraging other security gaps, may exploit this flaw to gain full control over the system, compromising confidentiality, integrity, and availability of the data stored on TrueNAS devices.
This vulnerability affects multiple versions of TrueNAS CORE, and iXsystems has confirmed its presence in the system’s default configuration. Since this flaw requires no prior authentication or user interaction, it poses a significant risk to unpatched systems in network-adjacent environments.
iXsystems has promptly released a patch to address the vulnerability. Users are strongly advised to update their systems to the latest version, TrueNAS CORE 13.0-U6.3, which resolves this issue.
Security researchers Daan Keuper, Thijs Alkemade, and Khaled Nassar from Computest Sector 7 discovered and disclosed the vulnerability, as per a report by Zero Day Initiative.
Their research emphasizes the importance of proactive security testing in identifying and mitigating critical vulnerabilities.
CVE-2024-11944 underlines the challenges of maintaining robust security in open-source software. Administrators using TrueNAS CORE are urged to apply the update immediately to prevent potential exploitation.
This incident also reminds us of the importance of frequent system updates and vigilant network security practices.
Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free
