Paper/Archive/CVE-2022-24989

CVE-2022-24989

terra-master terramaster_operating_system — TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters f…

EPSS 32%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 98.3.983 × 2019.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

terramaster_operating_system≤ 4.2.30–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refforum.terra-master.com/en/viewforum.php?f=28 refgithub.com/0xf4n9x/CVE-2022-24990 refpacketstormsecurity.com/files/172904 refattackerkb.com/topics/h8YKVKx21t/cve-2022-24990 refoctagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation