CVE-2022-24990 : TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agen

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Published 2023-02-07 18:15:09

Updated 2023-06-14 00:15:09

Source MITRE

View at NVD, CVE.org

CVE-2022-24990 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

TerraMaster OS Remote Command Execution Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.

Notes:

https://forum.terra-master.com/en/viewtopic.php?t=3030; https://nvd.nist.gov/vuln/detail/CVE-2022-24990

Added on 2023-02-10 Action due date 2023-03-03

Exploit prediction scoring system (EPSS) score for CVE-2022-24990

EPSS FAQ

93.96%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2022-24990

TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989

Disclosure Date: 2022-03-07

First seen: 2023-09-11

exploit/linux/http/terramaster_unauth_rce_cve_2022_24990

This module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.29 and lower by chaining two existing vulnerabilities, CVE-2022-24990 "Leaking sensitive information" and CVE-2022-24989, "Authenticated remote code execution".

More information

CVSS scores for CVE-2022-24990

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2022-24990

https://github.com/0xf4n9x/CVE-2022-24990

GitHub - 0xf4n9x/CVE-2022-24990: CVE-2022-24990 TerraMaster TOS unauthenticated RCE via PHP Object Instantiation
Exploit;Third Party Advisory

CVEs referencing this url
https://forum.terra-master.com/en/viewforum.php?f=28

TOS Update Notice - TerraMaster Official Forum
Issue Tracking;Release Notes

CVEs referencing this url
https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732

Attack: TerraMaster TOS RCE CVE-2022-24990
Third Party Advisory
https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/

CVE-2022-24990: TerraMaster TOS unauthenticated remote command execution via PHP Object Instantiation – Blog | Octagon Networks
Exploit;Third Party Advisory
http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html

TerraMaster TOS 4.2.29 Remote Code Execution ≈ Packet Storm

Products affected by CVE-2022-24990

Terra-master » Terramaster Operating System
Versions before (<) 4.2.31
cpe:2.3:o:terra-master:terramaster_operating_system:*:*:*:*:*:*:*:*
Matching versions
When used together with: Terra-master » F2-210 » Version: N/A
When used together with: Terra-master » F2-221 » Version: N/A
When used together with: Terra-master » F2-223 » Version: N/A
When used together with: Terra-master » F2-422 » Version: N/A
When used together with: Terra-master » F2-423 » Version: N/A
When used together with: Terra-master » F4-421 » Version: N/A
When used together with: Terra-master » F4-422 » Version: N/A
When used together with: Terra-master » F4-423 » Version: N/A
When used together with: Terra-master » F5-221 » Version: N/A
When used together with: Terra-master » F5-422 » Version: N/A
When used together with: Terra-master » T12-423 » Version: N/A
When used together with: Terra-master » T12-450 » Version: N/A
When used together with: Terra-master » T6-423 » Version: N/A
When used together with: Terra-master » T9-423 » Version: N/A
When used together with: Terra-master » T9-450 » Version: N/A
When used together with: Terra-master » U12-322-9100 » Version: N/A
When used together with: Terra-master » U12-423 » Version: N/A
When used together with: Terra-master » U12-722-2224 » Version: N/A
When used together with: Terra-master » U16-322-9100 » Version: N/A
When used together with: Terra-master » U16-722-2224 » Version: N/A
When used together with: Terra-master » U24-722-2224 » Version: N/A
When used together with: Terra-master » U4-111 » Version: N/A
When used together with: Terra-master » U4-211 » Version: N/A
When used together with: Terra-master » U4-423 » Version: N/A
When used together with: Terra-master » U8-111 » Version: N/A
When used together with: Terra-master » U8-322-9100 » Version: N/A
When used together with: Terra-master » U8-423 » Version: N/A
When used together with: Terra-master » U8-522-9400 » Version: N/A
When used together with: Terra-master » U8-722-2224 » Version: N/A