PT-2020-14498 · Terramaster · Terramaster Tos

Published 2020-08-16 · Updated 2021-07-21 · CVE-2020-15568

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions prior to 4.1.29

Description The issue is related to Invalid Parameter Checking, which leads to code injection as root. This is a dynamic class method invocation vulnerability in the include/exportUser.php file. An attacker can trigger a call to the exec method with OS commands in the opt parameter.

Recommendations For versions prior to 4.1.29, update to version 4.1.29 or later to resolve the issue. As a temporary workaround, consider restricting access to the include/exportUser.php file to minimize the risk of exploitation. Avoid using the opt parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-913

Related Identifiers

CVE-2020-15568

Affected Products

Terramaster Tos

References · 6

• 🔥 https://github.com/divinepwner/TerraMaster-TOS-CVE-2020-15568 · Exploit
• 🔥 https://ssd-disclosure.com/ssd-advisory-terramaster-os-exportuser-php-remote-code-execution · Exploit
• https://help.terra-master.com/TOS/view · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15568 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15568 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/1593 · Telegram Post