CVE-2024-6445 Overview
CVE-2024-6445 is a path traversal vulnerability in DataFlowX Technology DataDiodeX, a unidirectional data transfer (data diode) product used in segmented and high-assurance networks. The flaw stems from improper limitation of a pathname to a restricted directory [CWE-22]. Unauthenticated attackers can craft requests that escape the intended directory and access or manipulate files outside the permitted scope. The issue affects DataDiodeX versions from v3.0.0 before v3.1.7.
Critical Impact
An unauthenticated network-based attacker can traverse the file system to read, write, or replace sensitive files, undermining the integrity guarantees a data diode is deployed to provide.
Affected Products
- DataFlowX DataDiodeX v3.0.0 through versions prior to v3.1.7
- Deployments using DataDiodeX for cross-domain or segmented network transfers
- Environments relying on DataDiodeX for regulated data flow enforcement
Discovery Timeline
- 2024-09-06 - CVE-2024-6445 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2024-6445
Vulnerability Analysis
The vulnerability is a path traversal issue classified under [CWE-22]. DataDiodeX fails to properly canonicalize and validate file path input supplied through its network-facing interface. An attacker submits relative path sequences such as ../ or absolute paths in parameters that are later concatenated into file system operations. The application then resolves the path outside the intended restricted directory.
Because DataDiodeX mediates one-way data flows between trust zones, escaping the restricted directory can expose configuration files, transferred payloads, audit logs, and operating system files. The attack requires no authentication, no user interaction, and can be performed over the network. EPSS data places the exploitation probability at 0.587% (43rd percentile).
Root Cause
The root cause is missing or insufficient sanitization of user-controlled path components before they are used in file system operations. The application does not reject traversal sequences, does not enforce a canonical base directory check, and does not apply an allow-list of permitted file names. Path components are trusted as supplied by the remote client.
Attack Vector
The attack vector is network-based. A remote attacker sends a malformed request containing directory traversal sequences in a file or path parameter. DataDiodeX processes the path and performs the requested file system action against an arbitrary location accessible to the service account. Depending on which file system call is reached, the result is arbitrary file read, arbitrary file write, or arbitrary file overwrite. The vulnerability mechanism is described in the official advisories. See the Siber Güvenlik Notification TR-24-1409 and the USOM Notification TR-24-1409 for vendor-coordinated details.
Detection Methods for CVE-2024-6445
Indicators of Compromise
- Requests to DataDiodeX endpoints containing ../, ..\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences in path or filename parameters.
- Access attempts referencing sensitive system paths such as /etc/passwd, /etc/shadow, Windows \Windows\System32\config\, or DataDiodeX configuration directories.
- Unexpected file reads or writes by the DataDiodeX service account outside its working directory.
Detection Strategies
- Inspect HTTP and application-layer logs from DataDiodeX for path parameters containing traversal patterns, including encoded variants.
- Correlate DataDiodeX process file activity with network requests to identify file operations that resolve outside the configured transfer directory.
- Deploy IDS or WAF signatures that detect path traversal sequences targeting DataDiodeX listening ports.
Monitoring Recommendations
- Forward DataDiodeX application, access, and audit logs to a centralized SIEM for retention and correlation.
- Alert on file modifications to DataDiodeX binaries, configuration files, and any directory the service is not expected to write to.
- Baseline normal request patterns to the DataDiodeX interface and alert on anomalies in path length, character sets, or parameter structure.
How to Mitigate CVE-2024-6445
Immediate Actions Required
- Upgrade DataDiodeX to version v3.1.7 or later on all deployments.
- Restrict network access to the DataDiodeX management and data interfaces to known administrative and peer systems only.
- Review file system audit logs for evidence of prior traversal activity before applying the patch.
- Rotate any credentials, keys, or secrets that may have been stored in files accessible to the DataDiodeX service account.
Patch Information
The vendor addressed the vulnerability in DataDiodeX v3.1.7. All versions from v3.0.0 up to but not including v3.1.7 are affected and must be upgraded. Refer to the Siber Güvenlik Notification TR-24-1409 and USOM Notification TR-24-1409 for vendor remediation guidance.
Workarounds
- Place DataDiodeX behind a reverse proxy or WAF that blocks requests containing ../, ..\, and encoded traversal sequences.
- Enforce strict network segmentation so only authorized hosts can reach DataDiodeX service ports.
- Run the DataDiodeX service under a least-privilege account with file system permissions limited to its required directories.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
