CVE-2020-28188: TerraMaster TOS RCE Vulnerability

CVE-2020-28188 Overview

CVE-2020-28188 is a critical Remote Command Execution (RCE) vulnerability affecting TerraMaster TOS versions 4.2.06 and earlier. This vulnerability allows remote unauthenticated attackers to inject arbitrary OS commands via the /include/makecvs.php endpoint through the Event parameter. The vulnerability requires no authentication and can be exploited remotely over the network, making it particularly dangerous for internet-exposed TerraMaster NAS devices.

Critical Impact

Unauthenticated remote attackers can execute arbitrary operating system commands on vulnerable TerraMaster NAS devices, potentially leading to complete system compromise, data theft, or deployment of malware including botnet components.

Affected Products

• TerraMaster TOS versions up to and including 4.2.06
• All TerraMaster NAS devices running vulnerable TOS firmware

Discovery Timeline

• 2020-12-24 - CVE-2020-28188 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-28188

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly referred to as OS Command Injection. The flaw exists in the /include/makecvs.php script, which fails to properly sanitize user-supplied input in the Event parameter before passing it to operating system command execution functions.

The vulnerability has been actively leveraged in botnet campaigns. According to Checkpoint Research Botnet Analysis, this vulnerability was exploited as part of the "FreakOut" botnet campaign that targeted Linux devices. The attack requires no authentication or user interaction, allowing threat actors to compromise vulnerable devices at scale.

Root Cause

The root cause of CVE-2020-28188 is the lack of proper input validation and sanitization in the makecvs.php script. The Event parameter accepts user-controlled input that is directly incorporated into OS command execution without filtering dangerous characters or command injection sequences. This allows attackers to break out of the intended command context and execute arbitrary shell commands with the privileges of the web server process.

Attack Vector

The attack can be executed remotely over the network without any authentication. An attacker can send a specially crafted HTTP request to the vulnerable /include/makecvs.php endpoint, embedding malicious OS commands within the Event parameter. The vulnerable PHP script processes this input and executes the injected commands on the underlying operating system.

The exploitation mechanism involves sending HTTP requests to the vulnerable endpoint with command injection payloads in the Event parameter. Common attack patterns include using shell metacharacters such as semicolons, backticks, or pipe characters to chain malicious commands. For detailed technical analysis and proof-of-concept information, refer to the IHTeam TerraMaster Vulnerability Advisory and Packet Storm RCE Vulnerability.

Detection Methods for CVE-2020-28188

Indicators of Compromise

• HTTP requests containing command injection patterns targeting /include/makecvs.php
• Unusual process spawning from the web server process (e.g., /bin/sh, wget, curl)
• Network connections to known botnet command and control infrastructure
• Presence of unauthorized cryptocurrency miners or backdoor scripts on NAS devices

Detection Strategies

• Monitor web server access logs for requests to /include/makecvs.php with suspicious Event parameter values
• Implement network-based intrusion detection signatures for known exploitation patterns
• Deploy endpoint detection solutions capable of identifying command injection attempts and anomalous process behavior
• Scan for indicators associated with the FreakOut botnet campaign

Monitoring Recommendations

• Enable verbose logging on TerraMaster NAS devices and forward logs to a SIEM for analysis
• Monitor outbound network traffic from NAS devices for connections to unknown external hosts
• Regularly audit running processes and scheduled tasks for unauthorized entries
• Implement file integrity monitoring on critical system directories

How to Mitigate CVE-2020-28188

Immediate Actions Required

• Update TerraMaster TOS firmware to the latest available version that addresses this vulnerability
• Restrict network access to TerraMaster NAS devices using firewall rules
• Do not expose TerraMaster management interfaces directly to the internet
• Implement network segmentation to isolate NAS devices from critical infrastructure

Patch Information

TerraMaster has released firmware updates to address this vulnerability. Users should visit the TerraMaster Official Site to download the latest TOS firmware version. It is critical to apply the security update as soon as possible, especially for devices that may be accessible from the internet.

Workarounds

• Block external access to the TerraMaster web interface at the network perimeter
• Use a VPN for remote access to NAS devices instead of exposing them directly to the internet
• Implement web application firewall (WAF) rules to filter requests containing command injection patterns
• Disable or restrict access to the /include/makecvs.php endpoint if not required for normal operations

# Example: Block external access to TerraMaster web interface using iptables
iptables -A INPUT -p tcp --dport 8181 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8181 -j DROP