Description
TerraMaster <= 4.2.41 存在未授权远程命令执行漏洞
TerraMaster <= 4.2.41 未授权远程命令执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/TerraMaster-TOS-createRaid-%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E-CVE-2022-24989.md
https://zhuanlan.zhihu.com/p/646400737
https://www.rapid7.com/db/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990/
https://nvd.nist.gov/vuln/detail/CVE-2022-24990
https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
https://www.sentinelone.com/vulnerability-database/cve-2020-28188/
https://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html
https://forum.terra-master.com/en/viewtopic.php?f=28&t=3187