TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.
References
| Link | Resource |
|---|---|
| https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990 | Third Party Advisory |
| https://forum.terra-master.com/en/viewforum.php?f=28 | Release Notes |
| https://github.com/0xf4n9x/CVE-2022-24990 | Exploit |
| https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation | Exploit |
| https://packetstormsecurity.com/files/172904 | Exploit Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
| AND |
|
History
No history.
Information
Published : 2023-08-20 18:15
Updated : 2023-08-24 20:52
NVD link : CVE-2022-24989
Mitre link : CVE-2022-24989
CVE.ORG link : CVE-2022-24989
JSON object : View
Products Affected
terra-master
- u8-322-9100
- f4-421
- u16-722-2224
- f2-210
- u12-722-2224
- t9-423
- u8-423
- u24-722-2224
- f2-223
- f5-422
- u4-211
- u12-322-9100
- u4-423
- f2-423
- u16-322-9100
- u8-111
- t6-423
- t9-450
- f2-422
- u8-722-2224
- f5-221
- t12-423
- f4-423
- u8-522-9400
- terramaster_operating_system
- u12-423
- u4-111
- f4-422
- t12-450
- f2-221
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')