TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.
References
| Link | Resource |
|---|---|
| https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990 | Third Party Advisory |
| https://forum.terra-master.com/en/viewforum.php?f=28 | Release Notes |
| https://github.com/0xf4n9x/CVE-2022-24990 | Exploit |
| https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation | Exploit |
| https://packetstormsecurity.com/files/172904 | Exploit Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
| AND |
|
History
24 Aug 2023, 20:52
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:terra-master:u4-423:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u12-722-2224:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u16-322-9100:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u8-423:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f2-221:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u8-722-2224:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f2-423:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u12-423:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u12-322-9100:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f4-422:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u4-111:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f4-423:-:*:*:*:*:*:*:* cpe:2.3:o:terra-master:terramaster_operating_system:*:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u24-722-2224:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u8-111:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f2-422:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:t12-423:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:t9-423:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:t9-450:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f2-223:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:t6-423:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u8-522-9400:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f4-421:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u16-722-2224:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:t12-450:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f5-422:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u4-211:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:u8-322-9100:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f5-221:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:* |
|
| First Time |
Terra-master u8-322-9100
Terra-master t9-423 Terra-master f2-223 Terra-master u4-211 Terra-master u16-322-9100 Terra-master Terra-master f4-421 Terra-master f5-221 Terra-master u12-322-9100 Terra-master t12-450 Terra-master u8-111 Terra-master t12-423 Terra-master f2-423 Terra-master u16-722-2224 Terra-master f2-221 Terra-master u12-722-2224 Terra-master t6-423 Terra-master u24-722-2224 Terra-master f2-210 Terra-master f4-422 Terra-master u4-111 Terra-master u4-423 Terra-master f5-422 Terra-master f2-422 Terra-master u12-423 Terra-master u8-722-2224 Terra-master u8-522-9400 Terra-master u8-423 Terra-master f4-423 Terra-master terramaster Operating System Terra-master t9-450 |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-74 | |
| References | (MISC) https://github.com/0xf4n9x/CVE-2022-24990 - Exploit | |
| References | (MISC) https://forum.terra-master.com/en/viewforum.php?f=28 - Release Notes | |
| References | (MISC) https://packetstormsecurity.com/files/172904 - Exploit, Third Party Advisory, VDB Entry | |
| References | (MISC) https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation - Exploit | |
| References | (MISC) https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990 - Third Party Advisory |
20 Aug 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-20 18:15
Updated : 2023-12-10 15:14
NVD link : CVE-2022-24989
Mitre link : CVE-2022-24989
CVE.ORG link : CVE-2022-24989
JSON object : View
Products Affected
terra-master
- u8-111
- t12-450
- u8-322-9100
- f5-221
- t12-423
- u16-322-9100
- t6-423
- f2-223
- f2-423
- u12-423
- u4-423
- f2-210
- u8-722-2224
- u4-211
- u8-423
- f4-421
- u12-322-9100
- terramaster_operating_system
- u24-722-2224
- f2-422
- f4-423
- f4-422
- u4-111
- u8-522-9400
- t9-423
- t9-450
- f2-221
- u16-722-2224
- f5-422
- u12-722-2224
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')