CVE-2024-11944: TrueNAS CORE Directory Traversal RCE

CVE-2024-11944 Overview

CVE-2024-11944 is a directory traversal vulnerability in iXsystems TrueNAS CORE that enables remote code execution. The flaw resides in the tarfile.extractall method, which fails to validate user-supplied paths before performing file operations. Network-adjacent attackers can exploit this issue without authentication. When chained with other vulnerabilities, an attacker can execute code in the context of root. The issue was reported through the Zero Day Initiative as ZDI-CAN-25626 and disclosed as ZDI-24-1643.

Critical Impact
Unauthenticated network-adjacent attackers can write files outside the intended extraction directory, enabling arbitrary code execution as root on TrueNAS CORE appliances.

Affected Products

iXsystems TrueNAS CORE firmware 13.0 (including beta1, rc1)
iXsystems TrueNAS CORE firmware 13.0 updates U1 through U6.2
iXsystems TrueNAS hardware appliances running the affected firmware

Discovery Timeline

2024-12-30 - CVE-2024-11944 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11944

Vulnerability Analysis

The vulnerability is a classic path traversal weakness [CWE-22] within Python's tarfile.extractall handling on TrueNAS CORE. When the appliance processes a tar archive, entries inside the archive can contain relative paths such as ../../etc/cron.d/attacker or absolute paths. Because the code does not sanitize or restrict extraction targets, files can be written to arbitrary locations on the filesystem.

The attack surface is reachable from an adjacent network position and requires no authentication. An attacker chains the traversal primitive with additional weaknesses to achieve full command execution as root, giving complete control over the storage appliance, its datasets, and any hosted services.

Root Cause

The root cause is missing validation of member paths returned by tarfile.extractall. Python's standard library documents that extracting untrusted tar archives is unsafe unless each member's name is verified to remain within the intended destination directory. TrueNAS CORE invokes extractall on attacker-influenced archive data without enforcing that constraint, allowing traversal sequences to escape the target directory.

Attack Vector

Exploitation requires adjacent network access to the TrueNAS management service that consumes the crafted tar archive. The attacker delivers an archive containing entries with traversal payloads in their member names. When TrueNAS extracts the archive, files are written to attacker-chosen locations such as system configuration directories, cron paths, or startup scripts. Combined with a secondary weakness, the placed file is executed by a privileged process, yielding code execution as root.

No public proof-of-concept exploit code is available. See the Zero Day Initiative advisory ZDI-24-1643 for additional technical context.

Detection Methods for CVE-2024-11944

Indicators of Compromise

Unexpected files appearing under system directories such as /etc/, /usr/local/etc/, /var/spool/cron/, or startup script locations following an archive upload or import operation.
Tar archive uploads to the TrueNAS management interface containing entries with ../ sequences or absolute paths in member names.
New or modified cron entries, rc scripts, or middleware plugin files that do not correspond to administrator activity.

Detection Strategies

Inspect TrueNAS middleware logs (/var/log/middlewared.log) for archive extraction operations and correlate against filesystem change events.
Enable filesystem integrity monitoring against sensitive system paths on the appliance to flag writes originating from extraction routines.
Review web access logs for POST requests from adjacent-network hosts to endpoints that accept tar archive uploads.

Monitoring Recommendations

Restrict administrative and management network segments so only trusted hosts can reach TrueNAS CORE services, and monitor authentication and API activity on those segments.
Alert on process executions spawned by TrueNAS middleware that touch cron, init, or service-configuration directories.
Forward appliance syslog to a centralized platform such as Singularity Data Lake for retention, correlation with endpoint telemetry, and long-term hunting.

How to Mitigate CVE-2024-11944

Immediate Actions Required

Upgrade TrueNAS CORE to release 13.0-U6.3 or later as documented in the TrueNAS 13.0 Release Notes.
Restrict the TrueNAS web UI and API to trusted management VLANs and block adjacent-network access from untrusted hosts.
Audit the appliance for unexpected files under system directories and rotate any credentials, API keys, or certificates that may have been exposed.

Patch Information

iXsystems addressed the vulnerability in TrueNAS CORE 13.0-U6.3. Administrators should apply the update through the TrueNAS web UI update panel or via the CLI update procedure documented by the vendor. Verify the version by running freenas-version or checking System > General after reboot.

Workarounds

Place the TrueNAS management interface behind a firewall or dedicated management VLAN that only trusted administrators can reach.
Disable or restrict features that accept externally supplied archives (configuration imports, plugin installs, jail templates) until the patch is applied.
Require VPN authentication and multi-factor authentication for any user with network reachability to the appliance management plane.

bash

# Verify installed TrueNAS CORE version
freenas-version

# Example pf firewall rule limiting management access to a trusted subnet
# /etc/pf.conf
block in quick on $ext_if proto tcp to ($ext_if) port { 80, 443 }
pass in quick on $ext_if proto tcp from 10.10.0.0/24 to ($ext_if) port { 80, 443 }