Description
TerraMaster TOS是美国铁威马（Terra Master）公司的一套基于Linux平台开发的存储服务器专用操作系统。 该系统支持文件共享、云端数据同步、数据备份和虚拟化等功能。Terramaster TOS 存在命令执行漏洞，该漏洞源于api.php脚本中的VPN参数没有严格校验。
TerraMaster TOS /module/api.php 远程命令执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/TerraMaster%20TOS%20createRaid%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2022-24989.md
https://zhuanlan.zhihu.com/p/646400737
https://blog.csdn.net/qq_36334672/article/details/136450448
https://www.saury.net/2499.html
https://bbs.kanxue.com/thread-275545.htm
https://pwn.ai/blog/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation
https://www.exploit-db.com/exploits/50635
https://www.sonicwall.com/blog/terramaster-remote-command-execution-vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2022-24990
https://www.rapid7.com/db/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990/