antx-code / CVE-2022-24990

TerraMaster TOS Unauthenticated Remote Command Execution(RCE) Vulnerability CVE-2022-24990

CVE-2022-24990

---

Description

• POC for CVE-2022-24990: TerraMaster TOS unauthenticated remote command execution via PHP Object Instantiation.
• create by antx at 2022-04-12.

---

Detail

• The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
• The vulnerability exists due to improper input validation in the webNasIPS component in the api.php script. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.
• Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

---

CVE Severity

• attackComplexity: LOW
• attackVector: NETWORK
• availabilityImpact: HIGH
• confidentialityImpact: HIGH
• integrityImpact: HIGH
• privilegesRequired: NONE
• scope: UNCHANGED
• userInteraction: NONE
• version: 3.1
• baseScore: 10.0
• baseSeverity: CRITICAL

---

Affect

• TerraMaster TOS
  • < 4.2.30
  • All of 4.1.x

---

POC

• Poc

---

Patch

• vendor patch
• CNPD-2022-324076
• CNPD-202203-2299

---

Reference

• Ref-Source
  • CVE-2022-24990信息泄露+RCE 一条龙
  • Command Injection in TerraMaster TOS
• CVE
  • CVE-2022-24990
• CNVD
  • CNVD-2022-17750
• CNNVD
  • CNNVD-202203-1539
• Ref-Poc-Engine
  • pocx