漏洞描述
TerraMaster TOS before 4.1.29 has invalid parameter checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
ssd-disclosure.comhttps://ssd-disclosure.com/ssd-advisory-terramaster-os-exportuser-php-remote-code-execution/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2020-15568↗help.terra-master.comhttps://help.terra-master.com/TOS/view/↗github.comhttps://github.com/divinepwner/TerraMaster-TOS-CVE-2020-15568↗github.comhttps://github.com/n0bugz/CVE-2020-15568↗