Critical vulnerability in the TrueNAS CORE operating system developed by iXsystems, Inc. allows network attackers to execute arbitrary code without authentication CVE-2024-11944
Researchers from Computest Sector 7, including Daan Koiper, Tais Alkemade, and Khaled Nassar, discovered a vulnerability in the tarfile.extractall method used in TrueNAS CORE. Due to insufficient verification of the path specified by the user, an attacker can perform a directory bypass attack. It allows file manipulation, including remote code execution (RCE) with root privileges; despite a high CVSS rating of 7.5, operation is difficult due to the need for precise conditions.
At the same time, the risk is significant because it allows an attacker to gain complete control over the system, potentially compromising the confidentiality, integrity, and availability of data. This vulnerability affects multiple versions of TrueNAS CORE, including standard system configurations. iXsystems has already released a patch that addresses this issue in TrueNAS CORE 13.0-U6.3. Administrators are strongly advised to update their systems immediately to avoid possible exploitation.
The vulnerability was discovered during the Pwn2Own cybersecurity competition. This case once again emphasizes the need for timely system updates and compliance with network security regulations. The CVE-2024-11944 vulnerability is a challenge for TrueNAS CORE users who need to quickly respond to new threats. Vulnerability has become one of the most common
50 
48 
139 