CVE-2020-28187
📋 TL;DR
CVE-2020-28187 is a critical directory traversal vulnerability in TerraMaster TOS that allows authenticated attackers to read, edit, or delete any file on the system. This affects TerraMaster NAS devices running TOS version 4.2.06 or earlier. Attackers can exploit this through multiple API endpoints to compromise the entire filesystem.
💻 Affected Systems
- TerraMaster TOS
📦 What is this software?
Tos by Terra Master
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including data destruction, ransomware deployment, credential theft, and lateral movement to other systems on the network.
Likely Case
Data theft, file manipulation, service disruption, and potential privilege escalation leading to full system control.
If Mitigated
Limited impact if proper network segmentation, strict access controls, and file integrity monitoring are in place.
🎯 Exploit Status
Exploitation requires authentication but is straightforward once authenticated. Multiple proof-of-concept examples exist in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: TOS 4.2.07 or later
Vendor Advisory: https://www.terra-master.com/
Restart Required: Yes
Instructions:
1. Log into TerraMaster TOS web interface. 2. Navigate to Control Panel > General Settings > Update & Restore. 3. Check for updates and install TOS 4.2.07 or later. 4. Reboot the NAS after update completes.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to TerraMaster TOS web interface to trusted IP addresses only
Authentication Hardening
allEnforce strong passwords, enable 2FA if available, and disable default accounts
🧯 If You Can't Patch
- Isolate TerraMaster NAS on separate VLAN with strict firewall rules
- Implement file integrity monitoring and alert on unauthorized file access/modification
🔍 How to Verify
Check if Vulnerable:
Check TOS version in web interface: Control Panel > General Settings > About. If version is 4.2.06 or earlier, system is vulnerable.Check Version:
Check via web interface or SSH: cat /etc/versionVerify Fix Applied:
Verify TOS version is 4.2.07 or later. Test API endpoints with directory traversal payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Multiple failed authentication attempts followed by successful login
- Requests to vulnerable endpoints (/tos/index.php?editor/fileGet, /include/ajax/logtable.php, /include/core/index.php) with directory traversal patterns
Network Indicators:
- HTTP requests containing '../' or similar path traversal sequences
- Unusual file download patterns from NAS
SIEM Query:
source="terramaster" AND (uri="*editor/fileGet*" OR uri="*logtable.php*" OR uri="*core/index.php*") AND (uri="*../*" OR uri="*..\\*" OR param="*../*")