Vulnerability · Published Aug 20, 2023 · Assigned by mitre
CVE-2022-24989
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 31.9% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)31.9%top 1.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Metasploit
Official description
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.
Affected products (as reported)
References
- https://forum.terra-master.com/en/viewforum.php?f=28
- https://github.com/0xf4n9x/CVE-2022-24990
- https://packetstormsecurity.com/files/172904
- https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990
- https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation