Critical Bugs in TerraMaster TOS Could Open NAS Devices to Remote Hacking
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-24989 | TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantia TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used. NVD description · AI analysis pending | 9.8 | 32% | PoC ×3 |
| — | |
| CVE-2022-24990 | Unauthenticated RCE via Admin Password Leak in TerraMaster TOS 4.2.29 and earlier TerraMaster TOS (TerraMaster OS) versions 4.2.29 and earlier do not require authentication (CWE-306) on the mobile API endpoint module/api.php?mobile/webNasIPS, and a request presenting the User-Agent "TNAS" returns system information that includes the administrative account's password in the PWD field. An unauthenticated attacker with network access to the NAS web interface can send this request and read the response, obtaining full administrative credentials. With those credentials an attacker controls the NAS, and public proof-of-concept exploits chain this flaw with a PHP object-instantiation bug to achieve unauthenticated remote command execution. Any TerraMaster NAS running TOS 4.2.29 or earlier is affected, with internet-exposed devices at the greatest risk. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities Catalog (added 2023-02-10) with known ransomware use, carries an EPSS of roughly 84%, and CISA and press reports describe active attacks, including North Korean ransomware activity against healthcare and critical infrastructure. Do: Upgrade TerraMaster TOS to a release newer than 4.2.29 per the vendor's instructions, as required by the CISA KEV entry. If patching must wait, restrict the TOS web interface to trusted networks so unauthenticated users cannot reach module/api.php?mobile/webNasIPS. Check device logs for requests to the webNasIPS endpoint with a TNAS User-Agent and look for signs of post-compromise activity, since ransomware use of this flaw is known. | 7.5 | 84% | KEV ransomware PoC ×3 |
| largeon the order of tens of thousands of internet-exposed TerraMaster NAS devices (estimate, not a verified count) |
Full article391 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 07, 2022
Researchers have disclosed details of critical security vulnerabilities in TerraMaster network-attached storage (TNAS) devices that could be chained to attain unauthenticated remote code execution with the highest privileges.
The issues reside in TOS, an abbreviation for TerraMaster Operating System, and "can grant unauthenticated attackers access to the victim's box simply by knowing the IP address," Ethiopian cyber security research firm Octagon Networks' Paulos Yibelo said in a statement shared with The Hacker News.
TOS is the operating system designed for TNAS appliances, enabling users to manage storage, install applications, and backup data. Following responsible disclosure, the flaws were patched in TOS version 4.2.30 released last week on March 1, 2022.
One of the issues, tracked as CVE-2022-24990, concerns a case of information leak in a component called "webNasIPS," resulting in the exposure of TOS firmware version, the default gateway interface's IP and MAC address, and a hash of the administrator password.
The second shortcoming, on the other hand, relates to a command injection flaw in a PHP module called "createRaid" (CVE-2022-24989), resulting in a scenario where the two issues can be stringed together to submit a specially-crafted command to achieve remote code execution.
"All in all, this was a very interesting project," Yibelo said. "We have used multiple components of an information leak, along with another information leak of the machine's time, and chained it with an authenticated OS command injection to achieve unauthenticated remote code execution as root.
The disclosure arrives as TerraMaster NAS devices have also been subjected to Deadbolt ransomware attacks, joining the likes of QNAP and ASUSTOR, with the company noting that it addressed the vulnerabilities that were likely exploited by the threat actors to deploy the ransomware in TOS version 4.2.30.
It's not immediately clear if the same set of vulnerabilities discovered by Octagon Networks were weaponized for Deadbolt infections. We have reached out to TerraMaster for further comment, and we will update the story if we hear back.
"Fixed a security vulnerability related to the Deadbolt ransomware attack," the company noted, recommending users to "re-install the latest version of the TOS system (4.2.30 or later) to prevent unencrypted files from continuing to be encrypted."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/03/critical-bugs-in-terramaster-tos-could.html